GHSA-fwhg-jhxm-42v5

GHSA-fwhg-jhxm-42v5 PUBLISHED CVSS 4 MEDIUM

Record from GitHub Advisory Database · Published August 27, 2025

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk scores

CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Timeline

Aug 27, 2025 CVE Published
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fwhg-jhxm-42v5
vulnetix vdb fixes GHSA-fwhg-jhxm-42v5

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fwhg-jhxm-42v5/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://android.googlesource.com/platform/frameworks/base/+/7ba8c8f63f1b13b127c871749314a242ff022ae2 url
https://nvd.nist.gov/vuln/detail/CVE-2025-0083 advisory
https://android.googlesource.com/platform/packages/services/Telecomm/+/685c2fc2f6b40bb2113db77da270c7b7220791c4 url
https://source.android.com/security/bulletin/2025-03-01 url

Look up in the Resolve Platform →