{"id":"CVE-2025-41255","summary":"Cyberduck and Mountain Duck - Improper Certificate Store Handling","details":"Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions.\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.","aliases":["GHSA-vjjc-grpp-m655"],"modified":"2026-08-12T03:51:29.617652037Z","published":"2025-06-25T09:21:37.479Z","database_specific":{"cwe_ids":["CWE-266"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41255.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"last_affected":"4.17.5"}]}],"cna_assigner":"sba-research"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41255.json"},{"type":"ADVISORY","url":"https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-vjjc-grpp-m655"},{"type":"ADVISORY","url":"https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-01_Cyberduck_Mountain_Duck_Certificate_Handling"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41255"},{"type":"PACKAGE","url":"https://github.com/iterate-ch/cyberduck"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/iterate-ch/cyberduck","events":[{"introduced":"0"},{"fixed":"53bf5bba71249806e3fe4dec04be6db3a15355b0"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"9.1.6"},{"fixed":"9.1.6"}]}}],"versions":["release-9-1-5","release-9-1-4","release-9-1-3","release-9-1-2","release-9-1-1","release-9-1-0","release-9-0-2","release-9-0-1","release-9-0-0","release-8-9-0","release-8-8-2","release-8-8-1","release-8-8-0","release-8-7-3","release-8-7-2","release-8-7-1","release-8-7-0","release-8-6-2","release-8-6-1","release-8-6-0","release-8-5-9","release-8-5-8","release-8-5-7","release-8-5-6","release-8-5-5","release-8-5-4","release-8-5-3","release-8-5-2","release-8-5-1","release-8-5-0","release-8-4-5","release-8-4-4","release-8-4-3","release-8-4-2","release-8-4-1","release-8-4-0","release-8-3-3","release-8-3-2","release-8-3-1","release-8-3-0","release-8-2-3","release-8-2-2","release-8-2-1","release-8-2-0","release-8-1-2","release-8-1-1","release-8-1-0","release-8-0-1","release-8-0-0","release-7-10-2","release-7-10-1","release-7-10-0","release-7-9-3","release-7-9-2","release-7-9-1","release-7-9-0","release-7-8-5","release-7-8-4","release-7-8-3","release-7-8-2","release-7-8-1","release-7-8-0","release-7-7-2","release-7-7-1","release-7-7-0","release-7-6-5","release-7-6-4","release-7-6-3","release-7-6-2","release-7-6-1","release-7-6-0","release-7-5-2","release-7-5-1","release-7-5-0","release-7-4-3","release-7-4-2","release-7-4-1","release-7-4-0","release-7-3-1","release-7-3-0","release-7-2-7","release-7-2-6","release-7-2-5","release-7-2-4","release-7-2-3","release-7-2-2","release-7-1-2","release-7-1-1","release-7-1-0","release-7-0-3","release-7-0-2","release-7-0-1","release-7-0-0","release-6-9-12","release-6-9-11","release-6-9-10","release-6-9-9","release-6-9-8","release-6-9-7","release-6-9-6","release-6-9-5","release-6-9-4","release-6-9-3","release-6-9-2","release-6-9-1","release-6-9-0","release-6-8-4","release-6-8-3","release-6-8-2","release-6-8-1","release-6-8-0","release-6-7-2","release-6-7-1","release-6-7-0","release-6-6-2","release-6-6-1","release-6-6-0","release-6-5-0","release-6-4-6","release-6-4-5","release-6-4-4","release-6-4-3","release-6-4-2","release-6-4-1","release-6-4-0","release-6-3-5","release-6-3-4","release-6-3-3","release-6-3-2","release-6-3-1","release-6-3-0","release-6-2-11","release-6-2-10","release-6-2-9","release-6-2-8","release-6-2-7","release-6-2-6","release-6-2-5","release-6-2-4","release-6-2-3","release-6-2-2","release-6-2-1","release-6-2-0","release-6-1-0","release-6-0-3","release-6-0-2","release-6-0-1","$TAG_NAME","release-5-3-6","release-5-3-5","release-5-3-4","release-5-3-3","release-5-3-2","release-5-3-1","release-5-3-0","release-5-2-3","release-5-2-2","release-5-2-1","release-5-2-0","release-5-1-1","release-5-1-0","release-5-0-14","release-5-0-13","release-5-0-12","release-5-0-11","release-5-0-10","release-5-0-9","release-5-0-8","release-5-0-7","release-5-0-6","release-5-0-5","release-5-0-4","release-5-0-3","release-5-0-2","release-5-0-1","release-5-0","release-4-8-3","release-4-8-2","release-4-8-1","release-4-8","release-4-7-7","release-4-7-6","release-4-7-5","release-4-7-4","release-4-7-3","release-4-7-2","release-4-7-1","release-4-7","release-4-6-5","release-4-6-4","release-4-6-3","release-4-6-2","release-4-6-1","release-4-6","release-4-5-2","release-4-5-1","release-4-5","release-4-4-4","release-4-4-3","release-4-4-2","release-4-4-1","release-4-4","release-4-3","release-4-2-1","release-4-2","release-4-1-3","release-4-1-2","release-4-1-1","release-4-1","release-4-0-2","release-4-0-1","release-4-0","release-3-8-1","release-3-8","release-3-7","release-3-6-1","release-3-6","release-3-5-1","release-3-5","release-3-4-2","release-3-4-1","release-3-4","release-3-3-1","release-3-3","release-3-3-beta4","release-3-3-beta3","release-3-3-beta2","release-3-3-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41255.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}