CVE-2024-25711: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an…

PriorityP342high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.98%

57.8th percentile

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	diffoscope	< diffoscope 256 (forky)	diffoscope 256 (forky)
fedoraproject	fedora	—	—
reproducible_builds	diffoscope	< 256	256
reproducible_builds	diffoscope	>= 0 < 256	256
reproducible_builds	diffoscope	>= 0 < 256	256
reproducible_builds	diffoscope	>= 0 < 256	256

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

osv7.5HIGH

vendor_debian7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.