一、 漏洞 CVE-2025-25195 基础信息
漏洞标题
Zulip事件可能泄露私有频道名称
来源：AIGC 神龙大模型
漏洞描述信息
Zulip 是一个开源的团队聊天应用程序。每周由一个 cron 任务（在 50256f48314250978f521ef439cafa704e056539 中添加）将超过 180 天没有收到任何消息的频道降级为“不活跃”状态。然而，在执行此操作时，会将一个事件发送给组织中的所有用户，而不仅仅是该频道中的用户。该事件包含了私有频道的名称。同样，同一个提交（50256f48314250978f521ef439cafa704e056539）添加了当频道停止为“不活跃”时通知客户端的功能。首次向某个已有超过 180 天没有消息的私有频道发送消息时（这些频道已经被标记为“不活跃”），会将一个事件泄露给组织中的所有用户；此事件也包含了私有频道的名称。提交 75be449d456d29fef27e9d1828bafa30174284b4 和 a2a1a7f8d152296c8966f1380872c0ac69e5c87e 修复了该问题。这一漏洞仅存在于 `main` 分支中，而没有出现在任何已发布的版本中。
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
来源：AIGC 神龙大模型
漏洞类别
对异常条件的处理不恰当
来源：AIGC 神龙大模型
漏洞标题
Zulip events can leak private channel names
来源：美国国家漏洞数据库 NVD
漏洞描述信息
Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive." The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
来源：美国国家漏洞数据库 NVD
漏洞类别
信息暴露
来源：美国国家漏洞数据库 NVD
二、漏洞 CVE-2025-25195 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2025-25195 的情报信息

  • 标题： Events can leak private channel names · Advisory · zulip/zulip · GitHub -- 🔗来源链接

    标签： x_refsource_CONFIRM

    Events can leak private channel names · Advisory · zulip/zulip · GitHub

  • 标题： stream: Add field to track active status of stream. · zulip/zulip@50256f4 · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    stream: Add field to track active status of stream. · zulip/zulip@50256f4 · GitHub

  • 标题： CVE-2025-25195: Only send "active" change events to channel subscribers. · zulip/zulip@75be449 · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    CVE-2025-25195: Only send "active" change events to channel subscribers. · zulip/zulip@75be449 · GitHub

  • 标题： streams: Use a common func to send stream recently active update event. · zulip/zulip@a2a1a7f · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    streams: Use a common func to send stream recently active update event. · zulip/zulip@a2a1a7f · GitHub
  • https://nvd.nist.gov/vuln/detail/CVE-2025-25195