CVE-2025-13947

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13947", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-12-03T09:02:32.759Z", "datePublished": "2025-12-03T09:45:59.939Z", "dateUpdated": "2026-11-04T21:23:35.534Z"}, "containers": {"cna": {"title": "Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser."}], "affected": [{"vendor": "The WebKitGTK Team", "product": "webkitgtk", "versions": [{"status": "affected", "version": "0", "lessThan": "2.50.3", "versionType": "semver"}], "packageName": "webkitgtk", "collectionURL": "https://github.com/WebKit/WebKit", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkitgtk4", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el7_9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-2.el8_8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el9_7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el9_0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el9_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el9_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkit2gtk3", "defaultStatus": "affected", "versions": [{"version": "0:2.50.3-1.el9_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkitgtk", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "webkitgtk3", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:22789", "name": "RHSA-2025:22789", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:22790", "name": "RHSA-2025:22790", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23110", "name": "RHSA-2025:23110", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23433", "name": "RHSA-2025:23433", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23434", "name": "RHSA-2025:23434", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23451", "name": "RHSA-2025:23451", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23452", "name": "RHSA-2025:23452", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23583", "name": "RHSA-2025:23583", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23591", "name": "RHSA-2025:23591", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23742", "name": "RHSA-2025:23742", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23743", "name": "RHSA-2025:23743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-13947", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugs.webkit.org/show_bug.cgi?id=271957"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576", "name": "RHBZ#2418576", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-12-03T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "description": "Origin Validation Error", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-346: Origin Validation Error", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "timeline": [{"lang": "en", "time": "2025-12-03T08:57:27.767Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-03T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Janet Black for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:23:35.534Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T14:12:21.517767Z", "id": "CVE-2025-13947", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T15:17:58.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T14:12:21.517767Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T14:12:27.094Z"}}], "cna": {"title": "Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop", "credits": [{"lang": "en", "value": "Red Hat would like to thank Janet Black for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "The WebKitGTK Team", "product": "webkitgtk", "versions": [{"status": "affected", "version": "0", "lessThan": "2.50.3", "versionType": "semver"}], "packageName": "webkitgtk", "collectionURL": "https://github.com/WebKit/WebKit", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el7_9", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkitgtk4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_8", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.50.3-2.el8_8", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el9_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el9_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el9_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.50.3-1.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "webkit2gtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "webkitgtk", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "webkitgtk3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2025-12-03T08:57:27.767Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-03T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-12-03T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:22789", "name": "RHSA-2025:22789", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:22790", "name": "RHSA-2025:22790", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23110", "name": "RHSA-2025:23110", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23433", "name": "RHSA-2025:23433", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23434", "name": "RHSA-2025:23434", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23451", "name": "RHSA-2025:23451", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23452", "name": "RHSA-2025:23452", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23583", "name": "RHSA-2025:23583", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23591", "name": "RHSA-2025:23591", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23742", "name": "RHSA-2025:23742", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:23743", "name": "RHSA-2025:23743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-13947", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugs.webkit.org/show_bug.cgi?id=271957"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576", "name": "RHBZ#2418576", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "Origin Validation Error"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:23:35.534Z"}, "x_redhatCweChain": "CWE-346: Origin Validation Error"}}, "cveMetadata": {"cveId": "CVE-2025-13947", "state": "PUBLISHED", "dateUpdated": "2026-11-04T21:23:35.534Z", "dateReserved": "2025-12-03T09:02:32.759Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-12-03T09:45:59.939Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/WebKit/WebKit", "defaultStatus": "unaffected", "packageName": "webkitgtk", "product": "webkitgtk", "vendor": "The WebKitGTK Team", "versions": [{"lessThan": "2.50.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "webkitgtk4", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el7_9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-2.el8_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el9_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el9_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el9_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6::appstream"], "defaultStatus": "affected", "packageName": "webkit2gtk3", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.50.3-1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "webkitgtk", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "webkitgtk3", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en WebKitGTK. Esta vulnerabilidad permite la revelaci\u00f3n de informaci\u00f3n remota y asistida por el usuario que puede revelar cualquier archivo que el usuario tiene permiso para leer, mediante el abuso del mecanismo de arrastrar y soltar archivos donde WebKitGTK no verifica que las operaciones de arrastre se originan desde fuera del navegador."}], "id": "CVE-2025-13947", "lastModified": "2026-11-04T22:17:28.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13947", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T14:12:21.517767Z", "version": "2.0.3"}}]}, "published": "2025-12-03T10:15:47.710", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:22789"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:22790"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23110"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23433"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23434"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23451"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23452"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23583"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23591"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23742"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:23743"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-13947"}, {"source": "secalert@redhat.com", "url": "https://bugs.webkit.org/show_bug.cgi?id=271957"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Janet Black for reporting this issue.", "bugzilla": {"description": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop", "id": "2418576", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "status": "draft"}, "details": ["A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-13947", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "webkitgtk4", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "webkit2gtk3", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "webkit2gtk3", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-13947\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-13947"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T16:41:48.876089+00:00", "value": {"mitigation_remediation": ["Apply all applicable Red\u202fHat security updates that contain the WebKitGTK fix (e.g., RHSA\u20112025:22789, RHSA\u20112025:23434).", "If a patch is not applicable to your RHEL version, disable external drag\u2011and\u2011drop in the application or configure WebKitGTK to reject drag sources that originate outside the browser window.", "Rebuild or upgrade any applications that embed WebKitGTK to a version that incorporates the security update."], "summary": {"action": "Apply patch", "impact": "Information disclosure through drag\u2011and\u2011drop operations in WebKitGTK"}, "threat_synthesis": {"affected_systems": "The issue affects a wide range of Red\u00a0Hat Enterprise Linux releases, from RHEL\u00a06 and RHEL\u00a07 through RHEL\u00a09, including all extended and update support streams. The WebKitGTK component maintained by the WebKitGTK Team is the direct target of the flaw, and the vulnerability applies to all installations that use this library without a recent update.", "description_and_impact": "A flaw in WebKitGTK allows an attacker to obtain data that the user is authorized to read by manipulating the file drag\u2011and\u2011drop feature. The vulnerability, a CWE\u2011346 weakness of information exposure, does not require elevated privileges; it only abuses the component\u2019s failure to verify that a drag operation originates from outside the browser window. When an application allows external drag-and-drop, any file the user can open becomes readable to an attacker who can initiate the drag action, leading to confidentiality loss of local files.", "risk_and_exploitability": "The CVSS score of 7.4 indicates a high risk of exposure, while the EPSS score of less than 1\u202f% shows that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in CISA\u2019s KEV catalog, meaning no large\u2011scale exploitation has been documented. The attack requires user interaction to initiate drag\u2011and\u2011drop, which limits autonomous exploitation but still presents a significant threat to users who run applications built on WebKitGTK."}}}}, "created": "2026-04-20T16:45:11.955292+00:00", "updated": "2026-04-20T16:45:11.955304+00:00", "vendors": []}