CVE-2025-30038 HIGH

CVE-2025-30038: Session ID leakage in Zone.Identifier of downloaded files

Vendor Cgm
Product CGM CLININET
Weakness CWE-1230
Published August 27, 2025
Last update August 27, 2025

CVSS base score

7.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.

Key dates

02Disclosure timeline

August 27, 2025 CVE published
August 27, 2025 Record updated