{"id":"CVE-2019-15119","aliases":["EUVD-2019-6190","GHSA-2vp2-8m5j-4rjx","GO-2025-3625","openSUSE-SU-2025:15017-1"],"status":"published","title":"cnlh nps vulnerable to file overwrite by local user","description":"lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00955,"percentile":0.61648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2019-08-16T14:02:31Z","modified":"2026-10-20T10:52:23Z","fixes":[{"ecosystem":"Go","package":"ehang.io/nps","fixed_in":["0.23.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/cnlh/nps","fixed_in":["0.23.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"ehang.io/nps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.2"}]}]},{"source":"osv","ecosystem":"Go","package":"ehang.io/nps","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cnlh/nps","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250422T181640-1.1"}]}],"bundled":23}],"products":[{"vendor":"ehang-io","product":"nps"}],"references":[{"url":"https://github.com/cnlh/nps/issues/176","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/cnlh/nps/commit/7178b3380720e910d283036a8d39879a94105515","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15119","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2vp2-8m5j-4rjx","tags":["advisory"]},{"url":"https://github.com/cnlh/nps","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43973","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-15119","description":"lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.","status":"published","published":"2019-08-16T14:02:31Z","modified":"2024-08-05T00:34:53.253Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-6190","description":"lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.","status":"published","published":"2019-08-16T14:02:31Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.184704Z"}],"ghsa":[{"id":"GHSA-2vp2-8m5j-4rjx","title":"cnlh nps vulnerable to file overwrite by local user","description":"`lib/install/install.go` in cnlh nps prior to 0.23.2 uses 0777 permissions for `/usr/local/bin/nps and/or /usr/bin/nps`, leading to a file overwrite by a local user.","status":"published","published":"2022-05-24T16:53:50Z","modified":"2025-04-17T17:48:13Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:38:40.628275Z"}],"nvd":[{"id":"CVE-2019-15119","description":"lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.","status":"published","published":"2019-08-16T15:15:11.95Z","modified":"2026-06-17T02:19:44.413Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"CVE-2019-15119","description":"lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.","status":"published","published":"2019-08-16T15:15:11.95Z","modified":"2026-10-20T10:52:23.618518939Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"GHSA-2vp2-8m5j-4rjx","title":"cnlh nps vulnerable to file overwrite by local user","description":"`lib/install/install.go` in cnlh nps prior to 0.23.2 uses 0777 permissions for `/usr/local/bin/nps and/or /usr/bin/nps`, leading to a file overwrite by a local user.","status":"published","published":"2022-05-24T16:53:50Z","modified":"2025-04-22T18:57:04.164507Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GO-2025-3625","title":"cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps","description":"cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps","status":"published","published":"2025-04-22T18:14:45Z","modified":"2026-03-03T04:56:30.242148Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15017-1","title":"govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250422T181640-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-23T00:00:00Z","modified":"2026-02-04T02:34:16.37387Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}