mohammadzain2008 Linkr up to 2.0.0 URL signature verification

Summaryinfo

A vulnerability was found in mohammadzain2008 Linkr up to 2.0.0 and classified as critical. This affects an unknown function of the component URL Handler. The manipulation results in signature verification. This vulnerability is reported as CVE-2025-59334. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in mohammadzain2008 Linkr up to 2.0.0. Affected is an unknown code of the component URL Handler. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of .linkr manifest files before using their contents, allowing a tampered manifest to inject arbitrary file entries into a package distribution. An attacker can modify a generated .linkr manifest (for example by adding a new entry with a malicious URL) and when a user runs the extract command the client downloads the attacker-supplied file without verification. This enables arbitrary file injection and creates a potential path to remote code execution if a downloaded malicious binary or script is later executed. Version 2.0.1 adds a manifest integrity check that compares the checksum of the original author-created manifest to the one being extracted and aborts on mismatch, warning if no original manifest is hosted. Users should update to 2.0.1 or later. As a workaround prior to updating, use only trusted .linkr manifests, manually verify manifest integrity, and host manifests on trusted servers.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-59334 since 09/12/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.0.1 eliminates this vulnerability. Applying the patch 182e5ddaa51972e144005b500c4bcebf2fd1a6c0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• mohammadzain2008

Name

• Linkr

Version

• 2.0

License

• open-source

Website

• Product: https://github.com/mohammadzain2008/Linkr/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion