Overview
CVE-2025-41255 is a severe vulnerability that affects the popular open-source clients, Cyberduck and Mountain Duck. This vulnerability arises due to the erroneous handling of TLS certificate pinning for untrusted certificates, such as self-signed ones. The systems unnecessarily install these certificates to the Windows Certificate Store of the current user, without any restrictions, thereby opening the door to potential system compromise or data leakage. It is critical to address this issue, given the widespread use of these two applications in managing cloud storage and FTP servers.
Vulnerability Summary
CVE ID: CVE-2025-41255
Severity: High (8.0 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Cyberduck | Up to 9.1.6
Mountain Duck | Up to 4.17.5
How the Exploit Works
The exploit takes advantage of the improper handling of TLS certificate pinning in Cyberduck and Mountain Duck. When these applications encounter an untrusted certificate, they should reject it to maintain secure connections. However, due to this vulnerability, these applications instead install the untrusted certificate into the Windows Certificate Store of the current user. This behavior can be exploited by an attacker, who can present a self-signed certificate to these applications. Once installed, the attacker can potentially compromise the system or leak data.
Conceptual Example Code
Below is a conceptual example of how an attacker might exploit this vulnerability:
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
certificate=-----BEGIN CERTIFICATE-----[malicious_certificate]-----END CERTIFICATE-----In this example, the attacker sends a self-signed certificate to the vulnerable endpoint. The applications, instead of rejecting the certificate, install it into the Windows Certificate Store, giving the attacker the opportunity to compromise the system or leak data.