7.4

CVE-2025-13947: the webkitgtk team webkitgtk Origin Validation Error

CVSS: 7.4v3.1HighDeferred
AliasesUBUNTU-CVE-2025-13947DEBIAN-CVE-2025-13947
Published 03-12-2025Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2025-13947 is a high (CVSS 7.4) Origin Validation Error vulnerability in the webkitgtk team webkitgtk. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 6
DLA-4399-1DSA-6074-1MGASA-2025-0325OPENSUSE-SU-2026:20065-1RHSA-2025:22789RHSA-2025:22790

Timeline

  1. 03-12-2025
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu5 products
  • qtwebkit-opensource-srcAll versions (No fix recorded)
  • qtwebkit-sourceAll versions (No fix recorded)
  • webkit2gtkAll versions (No fix recorded) | < 2.50.3-0ubuntu0.22.04.1 | < 2.50.3-0ubuntu0.24.04.1 | < 2.50.3-0ubuntu0.25.10.1
  • webkitgtkAll versions (No fix recorded)
  • wpewebkitAll versions (No fix recorded)
Debian2 products
  • webkit2gtk< 2.50.3-1~deb12u1 | < 2.50.3-1~deb13u1 | < 2.50.3-1
  • wpewebkitAll versions (No fix recorded) | < 2.50.3-1
The webkitgtk team1 product

3 vendors · 8 products

References

19 links
Show all 19 references