CVE-2025-3908

6.2 mediumEPSS 0.2%

Medium (6.2) in openvpn openvpn3linux. EPSS 0.2% chance of exploitation in the next 30 days.

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Severity

CVSS 3.1

6.2 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-59
Published: 2025-05-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openvpn:openvpn3linux

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-3908
http://www.openwall.com/lists/oss-security/2025/05/20/2

Check your stack JSON