CVE-2025-54867

Katalog CVE

CVSS 7.0 · High EPSS 0,18%

Kerentanan UNIX Symbolic Link (Symlink) Following pada youki-dev youki. Skor CVSS 3.1 7.0 (High) menurut github.com.

Deskripsi (NVD)

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.

Rincian

Terbit di NVD

14 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.0 (High), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw advisory vendor
• https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37 patch
• https://github.com/youki-dev/youki/releases/tag/v0.5.5 release notes