CVE-2025-24364

Summary

CVE-2025-24364 is a vulnerability affecting vaultwarden, an unofficial Bitwarden-compatible server written in Rust. An authenticated attacker can exploit this issue by gaining access to the vaultwarden admin panel and executing arbitrary code on the system. To exploit this, the attacker could manipulate settings to use sendmail as the mail agent and craft a specially crafted favicon image containing the malicious commands. This vulnerability has been resolved in version 1.33.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.