CVE-2025-13947 – This vulnerability in WebKitGTK allows attacker... (How to Fix)

Q: What is the severity of CVE-2025-13947?

CVE-2025-13947 has a CVSS score of 7.4 (HIGH). This vulnerability in WebKitGTK allows attackers to trick users into dragging files from their local system into a malicious webpage, which can then read those files. This affects any system running vulnerable versions of WebKitGTK-based browsers like Epiphany or applications embedding WebKitGTK. Users must be tricked into performing a drag-and-drop action.

📋 TL;DR

This vulnerability in WebKitGTK allows attackers to trick users into dragging files from their local system into a malicious webpage, which can then read those files. This affects any system running vulnerable versions of WebKitGTK-based browsers like Epiphany or applications embedding WebKitGTK. Users must be tricked into performing a drag-and-drop action.

💻 Affected Systems

Products:

WebKitGTK
Epiphany browser
Applications using WebKitGTK

Versions: Specific versions not detailed in CVE; check Red Hat advisories for exact ranges

Operating Systems: Linux distributions using WebKitGTK (e.g., Red Hat, Fedora, Ubuntu)

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires user interaction (drag-and-drop) and affects systems where WebKitGTK is used for web rendering.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could exfiltrate sensitive files like SSH keys, configuration files, or documents from the user's system if the user drags them onto a malicious webpage.

🟠

Likely Case

Attackers could steal commonly accessed documents or files through social engineering campaigns tricking users into dragging files.

🟢

If Mitigated

With user awareness training and proper browser security settings, the risk is reduced as users would avoid dragging files onto untrusted sites.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires social engineering to trick users into dragging files; no authentication needed but user interaction is mandatory.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Red Hat advisories (e.g., RHSA-2025:22789) for specific patched versions

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:22789

Restart Required: Yes

Instructions:

1. Update WebKitGTK packages using your distribution's package manager. 2. For Red Hat systems: 'yum update webkitgtk'. 3. Restart affected browsers or applications.

🔧 Temporary Workarounds

Disable drag-and-drop in browser

linux

Configure browser settings to disable or restrict drag-and-drop functionality, though this may break legitimate use cases.

Use alternative browser

all

Temporarily switch to a non-WebKitGTK-based browser until patches are applied.

🧯 If You Can't Patch

Educate users to avoid dragging files from their system onto webpages, especially from untrusted sources.
Implement application whitelisting to restrict execution of untrusted web applications.

🔍 How to Verify

Check if Vulnerable:

Check WebKitGTK version against patched versions in Red Hat advisories; e.g., 'rpm -q webkitgtk' on Red Hat systems.

Check Version:

rpm -q webkitgtk || apt list --installed | grep webkitgtk

Verify Fix Applied:

Verify the installed WebKitGTK version matches or exceeds the patched version listed in vendor advisories.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns from browser processes
Failed attempts to read restricted files via browser

Network Indicators:

Unexpected outbound connections from browser to external servers after file drag events

SIEM Query:

Search for browser process accessing sensitive file paths (e.g., /home/*/.ssh/*) followed by network connections.

📊 Metadata

CVE ID: CVE-2025-13947

CVSS v3 Score: 7.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CWE: CWE-346

EPSS Score: 0.06% exploit probability (17.1th percentile)

Published: December 3, 2025

Last Updated: January 7, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13947, you might also want to check these: