All vulnerabilities
CVE-2025-0651

WARP: File symlink abuse might lead to deleting files belonging to SYSTEM user

Cloudflare WARP
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 25 Oct 2026FIRST EPSS
Fixed in2024.12.492.0Fixed versionCVE List
Published22 Jan 2025Updated 12 Feb 2025CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 Jan 2025, 17:34 UTCPublishedCVE List
  2. 25 Oct 2026, 19:02 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.

User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.

Text from CVE List

Affected versions 1

  • WARPaffected: all versions before 2024.12.492.0CVE List

References 1