CVE-2025-5030 in KillWxapkg
Summary
by MITRE • 05/21/2025
A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
This critical vulnerability in Ackites KillWxapkg version 2.4.1 represents a severe operating system command injection flaw that directly impacts the wxapkg file parser component. The vulnerability exists within the processFile function located in internal/unpack/unpack.go, where improper input validation allows malicious actors to inject arbitrary operating system commands. The issue has been classified as critical due to its potential for remote code execution and the fact that public exploitation methods have been documented, making it accessible to threat actors without specialized knowledge. The attack vector requires remote exploitation, meaning adversaries can trigger the vulnerability from external networks without requiring physical access to the target system.
The technical nature of this flaw aligns with CWE-78, which specifically addresses OS Command Injection vulnerabilities where untrusted input is directly incorporated into operating system commands without proper sanitization or validation. This type of vulnerability falls under the ATT&CK framework's technique T1059.001 for Command and Scripting Interpreter, where adversaries execute commands through legitimate system interfaces. The complexity of exploitation, while described as high, suggests that the vulnerability requires specific conditions or crafted payloads to successfully trigger the command injection, yet the public availability of exploitation techniques significantly reduces the barrier to entry for potential attackers.
The operational impact of this vulnerability extends beyond simple command execution, as successful exploitation could allow attackers to gain full control over the affected system. Attackers might leverage this vulnerability to install persistent backdoors, exfiltrate sensitive data, or establish command and control channels. The wxapkg file parser component typically handles package files that could be encountered in legitimate software distribution scenarios, making this vulnerability particularly dangerous in environments where users might unknowingly process malicious packages. The remote exploitation capability means that threat actors can target systems without requiring user interaction, potentially leading to widespread compromise across multiple systems.
Mitigation strategies should focus on immediate patching of the Ackites KillWxapkg component to version 2.4.2 or later, which should contain the necessary fixes for the command injection vulnerability. Organizations should also implement network segmentation to limit access to systems running this software and deploy intrusion detection systems to monitor for suspicious command execution patterns. Input validation and sanitization measures should be strengthened throughout the application, particularly in areas that handle file processing and user-supplied data. Additionally, security teams should conduct thorough vulnerability assessments of similar components within their infrastructure and implement principle of least privilege access controls to limit the potential impact of successful exploitation attempts. Regular security updates and penetration testing should be scheduled to identify and remediate similar vulnerabilities before they can be exploited by malicious actors.