CVE-2025-52991

LowCVSS 3.2/10Last modified Jun 17, 2026

Description

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-529923.2The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes t CVE-2025-529935.6A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the buil CVE-2025-529944.9gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7 CVE-2025-529956.6File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529964.3File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529977.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529989.8Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be CVE-2025-529998.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions CVE-2025-530007.8The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to CVE-2025-530029.8LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions CVE-2025-530038.2The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results CVE-2025-530049.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D