CVE-2025-13947
High · 7.4CVSS
7.4
EPSS
0.3%
Published
Dec 3, 2025
CISA due date
—
The record
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | webkit2 | 0 | 2.50.3-1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk3-soup2 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 15.6 | webkit2gtk4 | 0 | 2.50.4-150600.12.54.1 |
| openSUSE:Leap 16.0 | webkit2gtk3 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk3-soup2 | 0 | 2.50.4-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk4 | 0 | 2.50.4-160000.1.1 |
Related vulnerabilities
- CVE-2025-43536 A use-after-free issue was addressed with improved memory management. Also affects webkit2
- CVE-2025-43531 A race condition was addressed with improved state handling. Also affects webkit2
- CVE-2025-66287 A flaw was found in WebKitGTK. Also affects webkit2
- CVE-2025-43458 This issue was addressed through improved state management. Also affects webkit2
- CVE-2025-43443 This issue was addressed with improved checks. Also affects webkit2
- CVE-2025-43432 A use-after-free issue was addressed with improved memory management. Also affects webkit2
- CVE-2025-43434 A use-after-free issue was addressed with improved memory management. Also affects webkit2
- CVE-2025-43440 This issue was addressed with improved checks. Also affects webkit2