{"id":"CVE-2025-46717","aliases":["DEBIAN-CVE-2025-46717","EUVD-2025-14324","GHSA-98cv-wqjx-wx8f","UBUNTU-CVE-2025-46717"],"status":"published","title":"sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00374,"percentile":0.31736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-497"],"published":"2025-05-12T14:52:55Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"crates.io","package":"sudo-rs","fixed_in":["0.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"rust-sudo-rs","fixed_in":["0.2.5-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-sudo-rs","fixed_in":["0.2.5-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rust-sudo-rs","fixed_in":["0.2.8-1ubuntu2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"sudo-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.5"},{"fixed":"0.2.6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-sudo-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-sudo-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"sudo-rs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-sudo-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-1","0.2.1-2","0.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-sudo-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8-1ubuntu2"}]}],"versions":["0.2.4-1","0.2.5-3ubuntu1","0.2.5-4","0.2.5-5","0.2.5-5ubuntu1","0.2.5-5ubuntu3"]}],"products":[{"vendor":"trifectatech","product":"sudo"},{"vendor":"trifectatechfoundation","product":"sudo-rs"}],"references":[{"url":"https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8f","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46717","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-98cv-wqjx-wx8f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46717.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-46717","tags":["advisory"]},{"url":"https://github.com/trifectatechfoundation/sudo-rs","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-46717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46717","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-46717","title":"sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T14:52:55.408Z","modified":"2025-05-12T22:06:55.312Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-14324","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T14:52:55Z","modified":"2025-05-12T22:06:55Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:49.308721Z"}],"ghsa":[{"id":"GHSA-98cv-wqjx-wx8f","title":"sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders","description":"### Summary\n\nUsers with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`.\n\n### PoC\n\nAs root:\n```\n# mkdir /tmp/foo\n# chmod a-rwx /tmp/foo\n# touch /tmp/foo/secret_file\n```\nAs a user without any (or limited) sudo rights:\n```\n$ sudo --list /tmp/foo/nonexistent_file\nsudo-rs: '/tmp/foo/nonexistent_file': command not found\n$ $ sudo --list /tmp/foo/secret_file\nsudo-rs: Sorry, user eve may not run sudo on host.\n```\nI.e. the user can distinguish whether files exist.\n\n### Related\nOriginal sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.\n\n### Impact\nUsers with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.\n\n### Credits\nThis issue was identified by sudo-rs developer Marc Schoolderman","status":"published","published":"2025-05-13T14:08:18Z","modified":"2025-05-13T14:08:21Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2025-46717","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T15:16:01.26Z","modified":"2026-06-17T09:26:51.753Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:11:07.176032Z"}],"osv":[{"id":"CVE-2025-46717","title":"sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T14:52:55.408Z","modified":"2026-10-28T02:30:27.26204318Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-46717","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T15:16:01.26Z","modified":"2026-09-01T20:05:53.377412685Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-98cv-wqjx-wx8f","title":"sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders","description":"### Summary\n\nUsers with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`.\n\n### PoC\n\nAs root:\n```\n# mkdir /tmp/foo\n# chmod a-rwx /tmp/foo\n# touch /tmp/foo/secret_file\n```\nAs a user without any (or limited) sudo rights:\n```\n$ sudo --list /tmp/foo/nonexistent_file\nsudo-rs: '/tmp/foo/nonexistent_file': command not found\n$ $ sudo --list /tmp/foo/secret_file\nsudo-rs: Sorry, user eve may not run sudo on host.\n```\nI.e. the user can distinguish whether files exist.\n\n### Related\nOriginal sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.\n\n### Impact\nUsers with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.\n\n### Credits\nThis issue was identified by sudo-rs developer Marc Schoolderman","status":"published","published":"2025-05-13T14:08:18Z","modified":"2026-09-10T03:50:24.416906979Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2025-46717","description":"sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.","status":"published","published":"2025-05-12T15:16:00Z","modified":"2026-04-22T16:03:25.353038Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"}]}}