CVE-2025-59378
MEDIUM EPSS 3.4%
Published Sep 15, 20259mo ago · Modified Jun 17, 20262w ago
5.7 CVSS 3.1
Published Sep 15, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
3.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-669
References 2
- codeberg.org https://codeberg.org/guix/guix/commit/1618ca7aa2ee8b6519ee9fd0b965e15eca2bfe45
- guix.gnu.org https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerability-2025-2/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.