CVE-2025-41255

Name of the Vulnerable Software and Affected Versions: Cyberduck versions prior to 9.1.7 Mountain Duck versions prior to 4.17.6

Description: The issue concerns improper handling of TLS certificate pinning for untrusted certificates, such as self-signed ones. This results in the unnecessary installation of these certificates to the Windows Certificate Store of the current user without any restrictions.

Recommendations: For Cyberduck versions prior to 9.1.7, update to version 9.1.7 or later to resolve the issue. For Mountain Duck versions prior to 4.17.6, update to version 4.17.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the certificate installation process to minimize the risk of exploitation.