DailyCVE@dailycve
🟠 #Signal Desktop, Insecure File Storage, #CVE-2023-24069 (Medium) -DC-Oct2026-3079 https://dailycve.com/signal-desktop-insecure-file-storage-cve-2023-24069-medium-dc-oct2026-3079/
0000081
240 followersView on X
CVE-2023-24069(apple / linux_kernel)
LOWCVSS 3.3 · LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.
1.0/ 10 priority
Sources & remediation
Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-200
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- linux_kernel
- macos
- signal-desktop
- windows
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Products
linux_kernelmacossignal-desktopwindows
1 version affected across 4 products
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail4 entries
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | macos | - | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |
| App | signal | signal-desktop | - | - | - |