CVE-2025-30038 — Session ID leakage in Zone.Identifier of downloaded files

CVE-2025-30038

Session ID leakage in Zone.Identifier of downloaded files PUBLISHED

Description (CNA)

The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.

Affected (CNA)

Vendor / product	Versions
CGM / CGM CLININET	affected 0 before 2025.MS1

CWE

CWE-1230

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.