CVE-2025-67124

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59 CWE-367

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63fExploit, Third Party Advisory
https://github.com/svenstaro/miniserveProduct

Timeline

Published: Jan 23, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-671254.4A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG CVE-2025-67136.5An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handl CVE-2025-671337.5An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component CVE-2025-671359.8Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay CVE-2025-67147.5MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects Mong CVE-2025-671469.4Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, CVE-2025-671479.8Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' paramet CVE-2025-67159.8The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for att CVE-2025-671587.5An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv CVE-2025-671597.5Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.CVE-2025-67166.4The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Bu CVE-2025-671607.5An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.