Path traversal in Windscribe
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windscribe Service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23441.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Windscribe | Windscribe | 2.9.9.0 | — | No fix listed | CNA |
- Windscribe VendorWindscribe Affected 2.9.9.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:windscribe:windscribe:2.9.9:*:*:*:*:windows:*:* | 2.9.9 | Vulnerable | Windscribe |
- cpe:2.3:a:windscribe:windscribe:2.9.9:*:*:*:*:windows:*:* Versions 2.9.9 Vulnerable ·Windscribe
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6141
- 2026-10-03 Alias added: GHSA-2wj7-gph3-jwg6
References
Advisory 2
More Windscribe vulnerabilities
- TI-2018-08203 The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. CVSS 3.0HIGH 7.8
- TI-2025-40286 Windscribe for Linux 'changeMTU' local privilege escalation CVSS 4.0HIGH 7.3
- TI-2022-19660 Uncontrolled search path in Windscribe CVSS 3.1HIGH 7.8
- TI-2020-16687 All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege… CVSS 3.1HIGH 7.8
- TI-2020-14401 In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation. CVSS 3.1HIGH 7.8
- TI-2018-08079 Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain… CVSS 3.0HIGH 7.8
Sources
- CVE-2024-6141 · CVE Program
- CVE-2024-6141 · NVD
- FIRST EPSS
- GHSA-2wj7-gph3-jwg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences