SecuriTricks - CVE-2025-4613

Description

Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template

Product(s) Impacted

Vendor	Product	Versions
Google	Web Designer	<16.3.0.0407

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	google	web_designer	<16.3.0.0407	/	/	/	/	/	/	/

References

https://balintmagyar.com/articles/google-web-designer-path-traversal-client-side-rce-cve-2025-4613

CVSS Score

7.1 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: HIGH
Attack Requirements: PRESENT
Privileges Required: LOW
User Interaction: ACTIVE
Scope:
Confidentiality Impact: LOW
Integrity Impact: HIGH
Availability Impact: LOW
Exploit Maturity: NOT_DEFINED

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:X

View Vector String

Timeline

Published: June 12, 2025, 9:15 a.m.
Last Modified: June 12, 2025, 4:06 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve-coordination@google.com

CVE-2025-4613