svenstaro/miniserve · Security
miniserve affected by a TOCTOU and symlink race vulnerability
- GHSA ID
- GHSA-mxc8-4jqf-368q
- CVE ID
- CVE-2025-67124
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
CWEs
- CWE-59 · Improper Link Resolution Before File Access ('Link Following')
- CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition