PT-2025-21651 · Qt Company · Qt

Published 2025-05-16 · Updated 2025-09-25 · CVE-2025-4211

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.19 Qt versions 6.0.0 through 6.5.8 Qt versions 6.6.0 through 6.8.1

Description: The issue arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework includes QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile.

Recommendations: For Qt versions prior to 5.15.19, update to Qt 5.15.19 or later. For Qt versions 6.0.0 through 6.5.8, update to Qt 6.5.9 or later. For Qt versions 6.6.0 through 6.8.1, update to Qt 6.8.2 or later. As a temporary workaround, consider restricting access to the QDir::tempPath() function and related classes until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-4211

Affected Products

Qt

References · 8

• https://cve.org/CVERecord?id=CVE-2025-4211 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4211 · Security Note
• https://ubuntu.com/security/CVE-2025-4211 · Vendor Advisory
• https://codereview.qt-project.org/c/qt/qtbase/+/632231 · Note
• https://twitter.com/CVEnew/status/1923434474685301193 · Twitter Post
• https://t.me/cvetracker/24030 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1923391458721038349 · Twitter Post