CVE-2024-25711
diffoscope Path Traversal vulnerability
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
CVE-2024-25711- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
CVE-2024-25711- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-0035
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
EUVD-2024-0035- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-33w6-hvmq-gh4x No score
diffoscope Path Traversal vulnerability
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
GHSA-33w6-hvmq-gh4x- Updated
- 2026-11-02
OSVALPINE-CVE-2024-25711
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
ALPINE-CVE-2024-25711- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
CVE-2024-25711- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2024-25711
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
DEBIAN-CVE-2024-25711- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-25711
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
UBUNTU-CVE-2024-25711- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-33w6-hvmq-gh4x No score
diffoscope Path Traversal vulnerability
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
GHSA-33w6-hvmq-gh4x- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13792-1 No score
diffoscope-261-1.1 on GA media
These are all security issues fixed in the diffoscope-261-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13792-1- Updated
- 2026-11-02
OSVPYSEC-2024-41 No score
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
- Record
PYSEC-2024-41- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
diffoscopePyPI |
before 256 | 256 |
diffoscopeAlpine:v3.19 |
before 256-r0 | 256-r0 |
diffoscopeAlpine:v3.20 |
before 256-r0 | 256-r0 |
diffoscopeAlpine:v3.21 |
before 256-r0 | 256-r0 |
diffoscopeAlpine:v3.22 |
before 256-r0 | 256-r0 |
diffoscopeAlpine:v3.23 |
before 256-r0 | 256-r0 |
diffoscopeAlpine:v3.24 |
before 256-r0 | 256-r0 |
diffoscopeDebian:12 |
All versions, plus listed versions 240240+deb12u1241242243 Show 45 moreShow less244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288 |
None known |
diffoscopeDebian:13 |
before 256 | 256 |
diffoscopeDebian:14 |
before 256 | 256 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
diffoscopePyPI |
before 256, plus listed versions 100101102103104 Show 45 moreShow less105106107108110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150 |
256 |
diffoscopeUbuntu:16.04:LTS |
All versions, plus listed versions 33384142484951 |
None known |
diffoscopeUbuntu:18.04:LTS |
All versions, plus listed versions 878890build191build191ubuntu192ubuntu193ubuntu1 |
None known |
diffoscopeUbuntu:20.04:LTS |
All versions, plus listed versions 125131132133134135136137 |
None known |
diffoscopeUbuntu:22.04:LTS |
All versions, plus listed versions 180194build195200201 Show 4 moreShow less202203204205 |
None known |
diffoscopeUbuntu:24.04:LTS |
All versions, plus listed versions 249251253254255257258259 |
None known |
diffoscopeopenSUSE:Tumbleweed |
before 261-1.1 | 261-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25711 is a high vulnerability (CVSS 7.5) in Reproducible Builds Diffoscope, published February 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in diffoscope 256.
References
salsa.debian.org/reproducible-builds/diffoscope/-/issues/361
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47
nvd.nist.gov/vuln/detail/CVE-2024-25711
github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2024-41.yaml
Show 8 moreShow less
security.alpinelinux.org/vuln/CVE-2024-25711
security-tracker.debian.org/tracker/CVE-2024-25711
ubuntu.com/security/CVE-2024-25711
cve.org/CVERecord?id=CVE-2024-25711
suse.com/security/cve/CVE-2024-25711
Left out here: 210 versions. The JSON record has them.