GHSA-fq3w-p4fg-mw73
fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
GHSA-fq3w-p4fg-mw73 is a low vulnerability (CVSS 1.2) in fixurjavainstall, published June 25, 2026. No source lists public exploit code. Fixed in fixurjavainstall 0.8.1.
- Severity
- 1.2 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.8.1fixurjavainstall +1 more
Description
Impact
Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature.
Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.
Patches
At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.
Workarounds
Do not run fuji manual on non-dev builds for versions <= 0.8.0.
Additional Information
This bug results from development-only code being accidentally left in for release use.
Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual.
There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fixurjavainstallcrates.io | through 0.8.0 | 0.8.1 |
fixurjavainstallcrates.io | before 0.8.1 | 0.8.1 |
What each source reports
GitHub Advisories Score used
fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
Impact
Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature.
Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.
Patches
At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.
Workarounds
Do not run fuji manual on non-dev builds for versions <= 0.8.0.
Additional Information
This bug results from development-only code being accidentally left in for release use.
Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual.
There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.
- Record
GHSA-fq3w-p4fg-mw73- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-489
- Updated
- 2026-11-02
OSV
fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
Impact
Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature.
Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.
Patches
At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.
Workarounds
Do not run fuji manual on non-dev builds for versions <= 0.8.0.
Additional Information
This bug results from development-only code being accidentally left in for release use.
Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual.
There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.
- Record
GHSA-fq3w-p4fg-mw73- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-489
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.