CVE-2025-3033

What it actually does

Path traversal flaw allows selection of a malicious Windows .url shortcut to trigger upload of an unexpected file instead of the intended one; affects only Windows builds.

Why it matters to the business

Attackers can cause unauthorized file exfiltration or injection, risking data loss or further compromise in environments using the listed packages; remediation deadline pressure is low given false KEV status and stable low EPSS.

How an attack unfolds

Attacker plants a crafted .url file on the local filesystem; victim opens or selects it within the affected application on Windows, the path traversal logic resolves an unintended target, and an unexpected file is uploaded.

How to fix it

Upgrade keycloak-26.2 (Chainguard), keycloak-26.2-compat (Chainguard), and keycloak-26.2-iamguarded-compat (Chainguard) to version 26.2.5-r8 or later; apply vendor patches for the underlying path-handling component.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases; attempt reproduction with a test .url containing traversal payloads and verify only expected files are processed.

Typical attack path

1. Create malicious .url shortcut containing traversal sequence
2. Place file on target Windows filesystem
3. Social-engineer or automate selection of the shortcut
4. Trigger upload of unintended file via path resolution error

How to detect it

Search application and system logs for unexpected file paths or upload events originating from .url selections; correlate with Windows shortcut file creation timestamps near upload activity.

What your security team should do

• Apply the listed package upgrades within standard change windows
• Restrict local file selection dialogs to trusted directories where possible
• Add monitoring for anomalous file-upload events from Windows endpoints
• Review downstream dependents for similar path-handling issues