CVE-2025-12341: AntiDupl Auth Bypass Vulnerability

CVE-2025-12341 Overview

CVE-2025-12341 affects ermig1979 AntiDupl versions up to 2.3.12. The flaw resides in an unknown function within AntiDupl.NET.WinForms.exe, specifically in the Delete Duplicate Image Handler component. Attackers with local access can abuse link following [CWE-59] to manipulate file operations performed by the application.

The vendor was contacted before public disclosure but did not respond. No patch is currently available. Exploitation requires local access and low privileges, but successful attacks compromise confidentiality, integrity, and availability of targeted files.

Critical Impact
A local attacker can leverage symbolic or hard links to redirect the delete-duplicate operation, causing AntiDupl to modify or remove files outside its intended scope.

Affected Products

ermig1979 AntiDupl versions up to and including 2.3.12
Component: AntiDupl.NET.WinForms.exe Delete Duplicate Image Handler
Windows environments running the AntiDupl.NET desktop application

Discovery Timeline

2025-10-28 - CVE-2025-12341 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12341

Vulnerability Analysis

AntiDupl is an open-source utility that scans image collections and helps users delete duplicate files. The Delete Duplicate Image Handler in AntiDupl.NET.WinForms.exe performs file removal operations without adequately validating whether the target path is a symbolic link, hard link, or junction.

When the handler processes a deletion request, it follows the link to the underlying target and operates on the linked resource. An attacker who can place or influence file entries in a scanned directory can craft links that redirect the delete operation to arbitrary files the user has permission to access.

This link-following weakness [CWE-59] falls under file system vulnerabilities. Exploitation does not require network access or user interaction beyond the normal delete workflow the victim already intends to perform.

Root Cause

The root cause is improper handling of file system links prior to file deletion. The application resolves and acts on link targets rather than validating link type, ownership, or destination against the intended scan scope.

Attack Vector

The attack requires local access with low privileges. An attacker plants a symbolic link or hard link inside a directory that a victim scans with AntiDupl. When the victim selects the crafted entry as a duplicate and deletes it, the file system operation follows the link and affects the attacker-chosen target file.

No verified public proof-of-concept code is available. Refer to the VulDB entry #330127 for additional technical context.

Detection Methods for CVE-2025-12341

Indicators of Compromise

Presence of symbolic links, hard links, or NTFS junctions inside directories regularly scanned by AntiDupl
Unexpected deletion or modification of sensitive files immediately after AntiDupl duplicate-removal operations
File system audit events showing AntiDupl.NET.WinForms.exe accessing paths outside the user's designated image folders

Detection Strategies

Enable Windows object access auditing on directories that store user documents, credentials, and system configuration to capture deletions initiated by AntiDupl.NET.WinForms.exe
Alert on creation of reparse points or symbolic links inside user media directories by non-administrative processes
Correlate AntiDupl process activity with file deletions in paths that do not match the scanned image directory tree

Monitoring Recommendations

Track process execution and file operations of AntiDupl.NET.WinForms.exe through endpoint telemetry
Monitor for FSCTL_SET_REPARSE_POINT operations from low-privilege user contexts
Review scheduled or interactive AntiDupl runs performed by privileged accounts, since these amplify the impact of link redirection

How to Mitigate CVE-2025-12341

Immediate Actions Required

Restrict use of AntiDupl 2.3.12 and earlier to trusted directories that contain only user-owned image files
Avoid running AntiDupl under administrative or elevated user contexts to limit which files a redirected delete can affect
Inspect scan target directories for symbolic links, hard links, and junctions before performing delete operations

Patch Information

No vendor patch is available at the time of publication. The maintainer did not respond to disclosure attempts. Track the project repository and the VulDB advisory #330127 for updates.

Workarounds

Move duplicate scanning workflows to isolated, non-privileged user accounts with access only to image directories
Copy suspect image sets to a sandboxed folder that contains no links before scanning
Manually review the file list AntiDupl proposes for deletion and cancel operations targeting entries with reparse attributes

bash

# Enumerate reparse points (symlinks, junctions) under a scan directory on Windows
dir /A:L /S "C:\Users\Photos"

# Alternative using PowerShell to list links before running AntiDupl
Get-ChildItem -Path 'C:\Users\Photos' -Recurse -Force |
  Where-Object { $_.Attributes -match 'ReparsePoint' } |
  Select-Object FullName, Attributes, Target