CVE-2025-52968: freedesktop xdg-utils Unprotected Alternate Channel
Vulnerability summary
CVE-2025-52968 is a low (CVSS 2.7) Unprotected Alternate Channel vulnerability in freedesktop xdg-utils. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.8% of scored vulnerabilities.
Timeline
- 23-06-2025PublishedVulnerability first disclosed.
- 23-06-2025Last modifiedVulnerability information updated.
Description
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated2.7LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated2.7LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
- NVDNIST2.7LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.01 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- xdg-utilsAll versions (No fix recorded)
Freedesktop1 product
- xdg-utils≤ 1.2.1
Ubuntu1 product
- xdg-utilsAll versions (No fix recorded)
3 vendors · 3 products
