Vulnerability details

CVE-2025-4613

Google Web Designer App

Client side RCE in Google Web Designer App

CVSS 4.0

7.1High

Official description

Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (Google)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L`

Affected products

Vendor	Product	Versions	Source
Google	Web Designer App	v < 16.3.0.0407	CVEProject cvelistV5 (CNA)

References and advisories

https://balintmagyar.com/articles/google-web-designer-path-traversal-client-side-rce-cve-2025-4613

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-06-12
Last updated: 2026-02-26
State: Published
Assigner (CNA): Google

Exploit prediction (EPSS)

0.62%

Probability of exploitation in 30 days

50.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-20
Improper Input Validation