PT-2025-38061 · Luanox · Luanox

Vhyrro · Publicado 2025-09-16 · Atualizado 2025-09-17 · CVE-2025-59336

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Luanox versions prior to 0.1.1

Description Luanox is a module host for Lua packages. A file traversal vulnerability can cause a denial of service by overwriting Phoenix runtime files. Package names, such as ../../package, are not properly filtered during rockspec verification, allowing files to be stored at unintended relative path locations. This could potentially overwrite runtime files and cause the website to crash.

Recommendations Update to version 0.1.1 or later.

Exploit

Correção

DoS

Relative Path Traversal

Path traversal

Enumeração de Fraquezas

CWE-23

CWE-22

Identificadores relacionados

CVE-2025-59336

GHSA-42C5-X4PJ-4P3W

Produtos afetados

Luanox

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59336.json · Exploit
• https://github.com/lumen-oss/luanox/security/advisories/GHSA-42c5-x4pj-4p3w · Nota
• https://github.com/lumen-oss/luanox/commit/2b6237f3baaa1d905c491fca29f8301835721c46 · Nota
• https://github.com/lumen-oss/luanox/commit/5198640c9644e2fcef5809f83b9ab0a9b4d0eeb2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-59336 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-59336 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1968190784286457874 · Publicação no Twitter
• https://t.me/CVEtracker/32669 · Publicação no Telegram