CVE-2025-0651: File Manipulation in Cloudflare WARP

The core impact of CVE-2025-0651 lies in the potential for unauthorized file deletion by a low-privilege user. By crafting a series of symbolic links and triggering the 'Reset all settings' function, an attacker can trick the WARP service into deleting files it owns with System privileges. This could lead to a range of consequences, including system instability, application failures, and even denial of service. While the vulnerability requires local access and interaction with the WARP client, the System privileges escalation makes it a significant concern. The blast radius is limited to the files accessible through the targeted directory, but the potential for critical system files to be affected warrants immediate attention.

1. Reserved2025-01-22
2. Published2025-01-22
3. Modified2025-02-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0651 is to immediately upgrade Cloudflare WARP to version 2024.12.492.0 or later. This patched version addresses the improper privilege management issue and prevents the symbolic link manipulation. As a temporary workaround, restricting access to the C:\ProgramData\Cloudflare\warp-diag-partials directory could limit the attacker's ability to create malicious symlinks. However, this is not a complete solution and should only be considered until the upgrade can be implemented. After upgrading, verify the fix by attempting to create a symlink within the directory and triggering the 'Reset all settings' option; the WARP service should no longer delete system files.