PT-2025-45115 · Dosage · Dosage

Published 2025-11-04 · Updated 2025-11-12 · CVE-2025-64184

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dosage versions 3.1 and below

Description Dosage is a comic strip downloader and archiver. When downloading comic images, the software constructs target file names from various sources, including the page URL, image URL, and page content. The basename is stripped of directory-traversing characters, but the file extension is derived from the HTTP Content-Type header. This allows a remote attacker, or a Man-in-the-Middle if the comic is served over HTTP, to potentially write arbitrary files outside the intended target directory under certain conditions.

Recommendations Update to version 3.2.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-64184

GHSA-4VCX-3PJ3-44M7

Affected Products

Dosage

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64184.json · Exploit
• https://ubuntu.com/security/CVE-2025-64184 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vcx-3pj3-44m7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64184 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64184 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64184 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64184 · Vendor Advisory
• https://github.com/webcomics/dosage/security/advisories/GHSA-4vcx-3pj3-44m7 · Note
• https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e · Note
• https://github.com/webcomics/dosage · Note
• https://twitter.com/cracbot/status/1988562459557585084 · Twitter Post
• https://twitter.com/CVEnew/status/1986651576543645721 · Twitter Post
• https://t.me/cveNotify/142056 · Telegram Post
• https://twitter.com/CveFindCom/status/1986685279575429344 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1op46de/resumen_diario_de_vulnerabilidades_05112025 · Reddit Post