PT-2025-7781 · Tex Live+2 · Tex Live+2

Vicevirus · Published 2025-02-18 · Updated 2025-11-27 · CVE-2025-26525

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TeX Live (affected versions not specified)

Description The issue is related to insufficient sanitizing in the TeX notation filter, which poses an arbitrary file read risk on sites where pdfTeX is available. This typically affects systems with TeX Live installed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Files Accessible to External Parties

Weakness Enumeration

CWE-200

CWE-552

Related Identifiers

ALT-PU-2025-6924

ALT-PU-2025-7344

BDU:2025-02323

BIT-MOODLE-2025-26525

CVE-2025-26525

GHSA-4HMR-39VP-XFRR

Affected Products

Alt Linux

Red Os

Tex Live

References · 21

• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136 · Patch
• https://moodle.org/mod/forum/discuss.php?d=466141 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-26525 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hmr-39vp-xfrr · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/718393 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26525 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02323 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-26525 · Security Note
• https://osv.dev/vulnerability/BIT-moodle-2025-26525 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-26525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26525 · Security Note
• https://github.com/moodle/moodle · Note
• https://moodle.org/security · Note
• https://twitter.com/Hossted_OSS/status/1899018636083319085 · Twitter Post