CVE-2025-53095: Sunshine application-wide CSRF in the UI leads to command injection as Administrator
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can trigger unintended actions within the Sunshine application on behalf of that user. Specifically, since the application does OS command execution by design, this issue can be exploited to abuse the "Command Preparations" feature, enabling an attacker to inject arbitrary commands that will be executed with Administrator privileges when an application is launched. This issue has been patched in version 2025.628.4510.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53095?
CVE-2025-53095 is categorized as a medium severity vulnerability due to the potential for Cross-Site Request Forgery (CSRF) attacks.
How do I fix CVE-2025-53095?
To fix CVE-2025-53095, upgrade to Sunshine version 2025.628.4510 or later.
What kind of attacks can CVE-2025-53095 enable?
CVE-2025-53095 can enable Cross-Site Request Forgery (CSRF) attacks, allowing attackers to perform unauthorized actions on behalf of authenticated users.
Who is affected by CVE-2025-53095?
CVE-2025-53095 affects all users of Sunshine versions prior to 2025.628.4510.
Is user authentication sufficient to prevent CVE-2025-53095?
No, user authentication alone is not sufficient to prevent CVE-2025-53095, as the vulnerability specifically exploits the absence of CSRF protection.