A critical vulnerability in the Linkr file delivery system allows for the execution of unauthorized or malicious files due to a lack of manifest integrity verification, posing a severe risk of system compromise.

The application processes .linkr manifest files without verifying their cryptographic signature or integrity, allowing an attacker to manipulate the file delivery process to execute arbitrary code.

By bypassing integrity checks, an attacker can influence the application to download and execute malicious payloads under the guise of legitimate files. A CVSS score of 9.6 indicates a critical risk, where successful exploitation could lead to full system takeover and the distribution of malicious software across the user base.

Immediate Action: Update Linkr to the latest secure version that implements manifest integrity and signature verification.

Proactive Monitoring: Monitor file download logs for suspicious manifest sources and audit the integrity of files within the delivery pipeline.

Compensating Controls: Implement strict egress filtering to restrict the application from reaching untrusted or non-whitelisted domains for file downloads.

Public Exploit Available: Unknown

The lack of manifest verification in Linkr is a critical architectural flaw that undermines the security of the entire file delivery process. Users and administrators must prioritize an upgrade to a patched version to prevent the delivery of malicious payloads.