CVE-2025-67124

Katalog CVE

CVSS 6.8 · Medium EPSS 0,33%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada svenstaro miniserve. Skor CVSS 3.1 6.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

Rincian

Terbit di NVD

23 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f exploit · advisory pihak ketiga
• https://github.com/svenstaro/miniserve product