thevindu-w clip_share_server up to 3.8.4 on Windows clip_share.exe uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, was found in thevindu-w clip_share_server up to 3.8.4 on Windows. This affects an unknown part in the library CRYPTBASE.dll of the file clip_share.exe. Such manipulation leads to uncontrolled search path. This vulnerability is traded as CVE-2025-49148. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in thevindu-w clip_share_server up to 3.8.4 on Windows and classified as critical. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file clip_share.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileged user who can write to the folder containing clip_share.exe can place malicious DLLs there, leading to arbitrary code execution in the context of the server, and, if launched by an Administrator (or another elevated user), it results in a reliable local privilege escalation. This vulnerability is fixed in 3.8.5.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-49148 since 06/02/2025. The exploitation is known to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

Upgrading to version 3.8.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• thevindu-w

Name

• clip_share_server

Version

• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4

Website

• Product: https://github.com/thevindu-w/clip_share_server/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion