Log in Start free

Vulnerability · Published May 21, 2025 · Assigned by VulDB

CVE-2025-5030Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injection

Medium 5.0

In plain English

A medium-severity OS command injection in KillWxapkg from Ackites. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/Ackites/KillWxapkgno fix listedGHSA-w6p4-84vc-qc2w
Gogithub.com/Ackites/KillWxapkgno fix listedGO-2025-3773

Affected products (as reported)

VendorProductVersions
Ackites KillWxapkg 2.4.02.4.1

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References