CVE-2025-54652

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization module.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Huawei	HarmonyOS	5.0.2; 5.0.1

References

https://consumer.huawei.com/cn/support/bulletinlaptops/2025/8/Vendor Advisory

Timeline

Published: Aug 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-546536.5Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality CVE-2025-546545.5Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality CVE-2025-546557.8Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality CVE-2025-546566.5** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Ex CVE-2025-546587.8An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outloo CVE-2025-546597.5An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR CVE-2025-54664.9XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Iva CVE-2025-546605.5An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientW CVE-2025-546675.3Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use CVE-2025-546686.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored CVE-2025-546699.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Inj CVE-2025-54673.3It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group