CVSS 3.1
6.8 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2025-67124
Medium (6.8) in svenstaro miniserve. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in miniserve 0.32.0.
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-59, CWE-367
- Published
- Modified
- Record from
- the NVD, synced
Affected
- svenstaro:miniserve
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mxc8-4jqf-368q | crates.io | miniserve | <0.32.0 | 0.32.0 |