# CVE-2025-14602: vsDesk weak file name generation

Source: https://junglewise.ai/threats/cve-2025-14602-vsdesk-weak-file-name-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-14602 · Severity: info · CVSS 5.3 · Published 2026-08-20

vsDesk is a remote support and file-sharing application. The application generates uploaded file names using predictable timestamps, allowing attackers to guess or brute-force filenames and access files that were meant to be confidential. This could enable further attacks such as accessing sensitive documents or leveraging the uploaded files to compromise systems.

Technologies: [vsDesk](https://junglewise.ai/threats/technologies/vsdesk). Vendors: [vsDesk](https://junglewise.ai/threats/vendors/vsdesk).

## Quick answers

**Is CVE-2025-14602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14602 being exploited in the wild.

**How severe is CVE-2025-14602?** Informational severity, with a CVSS score of 5.3, published 20 August 2026.

**Which products and versions are affected?** vsDesk 11.06.02 through 14.0100.

**Is there a fix for CVE-2025-14602?** A patch was published on 2026-08-20: Fixed in versions 14.0101 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14602 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-14602?** Check whether you run vsDesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

vsDesk contains an insecure file name generation vulnerability (CWE-330: Use of Insufficiently Random Values) where uploaded files are named using weak, timestamp-based methods. The vulnerability is network-reachable and requires authentication (PR:L). An attacker can accurately predict or brute-force generated filenames within a short time window to access uploaded files that should be confidential. The attack vector is network-based with low attack complexity. Versions 14.0101 and later contain the fix.

## Affected products

- vsDesk vsDesk 11.06.02 through 14.0100

## Timeline

- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 14.0101 and later

## References

- [https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md](https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md)

## Related threats

- [vsDesk missing server-side file validation in CSV import](https://junglewise.ai/threats/cve-2026-2334-vsdesk-missing-server-side-file-validation-in-csv-import)
- [vsDesk OS command injection in Task Scheduler](https://junglewise.ai/threats/cve-2025-14601-vsdesk-os-command-injection-in-task-scheduler)
- [vsDesk blind SQL injection via user input](https://junglewise.ai/threats/cve-2025-14603-vsdesk-blind-sql-injection-via-user-input)
- [vsDesk insecure deserialization and path traversal in configuration](https://junglewise.ai/threats/cve-2025-14600-vsdesk-insecure-deserialization-and-path-traversal-in)