Javier Fernandez-Sanguino Pen~A

**Name of the Vulnerable Software and Affected Versions** yiff-server version 2.14.2 **Description** The issue allows local users to read arbitrary files due to the yiff-server not properly verifying ownership of files that it opens. This is because the server runs as root on Debian GNU/Linux. **Recommendations** For version 2.14.2, consider restricting file access permissions to prevent unauthorized reading of files until a proper fix is applied. As a temporary workaround, consider running the yiff-server with reduced privileges to minimize the risk of exploitation.