CVE-2025-54867 | THREATINT

Description

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.

PUBLISHED Reserved 2025-07-31 | Published 2025-08-14 | Updated 2025-08-14 | Assigner GitHub_M

HIGH: 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-61: UNIX Symbolic Link (Symlink) Following

Product status

< 0.5.5

affected

References

github.com/.../youki/security/advisories/GHSA-j26p-6wx7-f3pw

github.com/...ommit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37

github.com/youki-dev/youki/releases/tag/v0.5.5

cve.org (CVE-2025-54867)

nvd.nist.gov (CVE-2025-54867)

Download JSON