CVE-2025-0651: File symlink abuse might lead to deleting files belonging to SYSTEM user
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.
User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0651?
CVE-2025-0651 is classified as a medium severity vulnerability due to improper privilege management allowing unauthorized file manipulation.
How do I fix CVE-2025-0651?
To fix CVE-2025-0651, update your Cloudflare WARP software to a version newer than 2024.12.492.0.
Who is affected by CVE-2025-0651?
CVE-2025-0651 affects users of Cloudflare WARP on Windows versions up to 2024.12.492.0.
What does CVE-2025-0651 allow an attacker to do?
CVE-2025-0651 allows an attacker with low system privileges to create symlinks for file manipulation within the Cloudflare WARP directory.
Is there a known exploit for CVE-2025-0651?
As of now, there is no publicly known exploit for CVE-2025-0651, but it is advisable to take preventive measures.