PT-2025-23884 · Aerc · Aerc

Published 2025-06-05 · Updated 2025-06-05 · CVE-2025-49466

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions aerc versions before 93bec0d

Description The issue allows directory traversal in the commands/msgview/open.go file due to direct path concatenation of the name of an attachment part. This is caused by the lack of proper validation of attachment names, which can lead to unauthorized access to files outside the intended directory.

Recommendations For versions before 93bec0d, consider restricting access to the open.go file in the commands/msgview directory until a patch is available. As a temporary workaround, avoid using the open command for attachments to minimize the risk of exploitation. Update to a version after 93bec0d to resolve the issue.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-49466

Affected Products

Aerc

References · 12

• 🔥 https://git.sr.ht/~rjarry/aerc/commit/93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-49466 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49466 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49466 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49466 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49466 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49466 · Vendor Advisory
• https://git.sr.ht/~rjarry/aerc/commit/2bbe75fe0bc87ab4c1e16c5a18c6200224391629 · Note
• https://t.me/cvenotify/124707 · Telegram Post
• https://twitter.com/CVEnew/status/1930471133859533171 · Twitter Post
• https://t.me/cvetracker/25470 · Telegram Post