PT-2025-4764 · Fedora · Fedora Repository

Matthew Galligan · Published 2025-01-23 · Updated 2025-01-24 · CVE-2025-23011

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fedora Repository version 3.8.1

Description The issue allows path traversal when extracting uploaded archives, also known as "Zip Slip". A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request.

Recommendations For Fedora Repository version 3.8.1, migrate to a currently supported version, such as 6.5.1, to resolve the issue. As a temporary workaround, consider restricting access to the archive upload feature until the migration is complete. Additionally, avoid using the vulnerable archive extraction functionality until the issue is resolved by migrating to the supported version.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

BDU:2026-00528

CVE-2025-23011

Affected Products

Fedora Repository

References · 13

• https://osv.dev/vulnerability/CVE-2025-23011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00528 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23011 · Security Note
• https://github.com/fcrepo/fcrepo/releases · Note
• https://github.com/fcrepo-exts/migration-utils · Note
• https://twitter.com/CveFindCom/status/1882526922506207337 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json · Note
• https://github.com/advisories/GHSA-p2j4-x5h5-fmjm · Note
• https://t.me/cvedetector/16227 · Telegram Post
• https://service.securitm.ru/vm/vulnerability/cve/show/CVE-2025-23011 · Note
• https://twitter.com/bluepinksec/status/1882684887209029774 · Twitter Post
• https://twitter.com/CVEnew/status/1882612837375463650 · Twitter Post
• https://twitter.com/CVETracker/status/1882881293714616502 · Twitter Post