CVE-2025-5030

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-5030
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5030.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-5030
Aliases
Downstream
Related
Published
2025-05-21T16:31:04.911Z
Modified
2026-07-15T01:49:06.568259381Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injection
Details

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Database specific 
{
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5030.json"
}
References

Affected packages

Git / github.com/ackites/killwxapkg

Affected ranges

Type
GIT
Repo
https://github.com/ackites/killwxapkg
Events
Introduced
d9293bd44b7ab232b747492a10dd339e83be4d9d
Last affected
eb2d734e449d8b4affe724238eb84e1cfbcc173d
Database specific 
{
    "cpe": "cpe:2.3:a:ackites:killwxapkg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.0"
        },
        {
            "introduced": "2.4.1"
        },
        {
            "last_affected": "2.4.1"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*
2.4.0
2.4.1
v2.*
v2.4.0
v2.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5030.json"