{"id":"CVE-2025-68462","aliases":["DEBIAN-CVE-2025-68462","EUVD-2025-204034","GHSA-gjwv-45pm-f62j","UBUNTU-CVE-2025-68462"],"status":"published","title":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory,...","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00114,"percentile":0.01487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2025-12-18T05:14:11Z","modified":"2026-09-01T20:05:57Z","fixes":[{"ecosystem":"Debian:13","package":"freedombox","fixed_in":["25.9.3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freedombox","fixed_in":["25.17.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.10","23.11","23.12","23.12~bpo12+1","23.13","23.13~bpo12+1","23.14","23.14~bpo12+1","23.15","23.15~bpo12+1","23.16","23.16~bpo12+1","23.17","23.17~bpo12+1","23.18","23.18~bpo12+1","23.19","23.19~bpo12+1","23.20","23.20~bpo12+1","23.21","23.21~bpo12+1","23.6.2","23.6.2+deb12u1","23.7","23.8","23.9","24.1","24.10","24.10~bpo12+1","24.11","24.11~bpo12+1","24.12","24.12~bpo12+1","24.13","24.13~bpo12+1","24.14","24.14~bpo12+1","24.15","24.15~bpo12+1","24.16","24.16~bpo12+1","24.17","24.17~bpo12+1","24.18","24.18~bpo12+1","24.19","24.1~bpo12+1","24.2","24.20","24.20.1","24.20.1~bpo12+1","24.21","24.21~bpo12+1","24.22","24.22~bpo12+1","24.23","24.23~bpo12+1","24.24","24.24~bpo12+1","24.25","24.25~bpo12+1","24.26","24.26.1","24.26.1~bpo12+1","24.2~bpo12+1","24.3","24.3~bpo12+1","24.4","24.4~bpo12+1","24.5","24.5~bpo12+1","24.6","24.7","24.7~bpo12+1","24.8","24.8~bpo12+1","24.9","24.9~bpo12+1","25.1","25.10","25.10~bpo13+1","25.11","25.11~bpo13+1","25.12","25.12~bpo13+1","25.13","25.13.1","25.13.1~bpo13+1","25.13~bpo13+1","25.14","25.14~bpo13+1","25.15","25.15~bpo13+1","25.16","25.16~bpo13+1","25.17","25.17.1","25.17.1~bpo13+1","25.17~bpo13+1","25.1~bpo12+1","25.2","25.3","25.3.1","25.3.1~bpo12+1","25.4","25.4.1","25.4.1~bpo12+1","25.5","25.5~bpo12+1","25.6","25.6~bpo12+1","25.7","25.7~bpo12+1","25.8","25.8~bpo12+1","25.9","25.9.1","25.9.1~bpo12+1","25.9.2","25.9.2~bpo12+1","25.9.3","25.9.3~bpo12+1","25.9.3~bpo12+2","25.9.4","25.9~bpo12+1","26.1","26.10","26.10~bpo13+1","26.11","26.11.1","26.11.1~bpo13+1","26.1~bpo13+1","26.2","26.2~bpo13+1","26.3","26.4","26.4.1","26.4.2","26.4.2~bpo13+1","26.4~bpo13+1","26.5","26.5.1","26.5.1~bpo13+1","26.6","26.6~bpo13+1","26.7","26.7.1","26.7.1~bpo13+1","26.8","26.8~bpo13+1","26.9","26.9.1","26.9.1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.9.3+deb13u1"}]}],"versions":["25.9.3"]},{"source":"osv","ecosystem":"Debian:14","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.17.1"}]}],"versions":["25.10","25.10~bpo13+1","25.11","25.11~bpo13+1","25.12","25.12~bpo13+1","25.13","25.13.1","25.13.1~bpo13+1","25.13~bpo13+1","25.14","25.14~bpo13+1","25.15","25.15~bpo13+1","25.16","25.16~bpo13+1","25.17","25.17.1~bpo13+1","25.17~bpo13+1","25.9.3","25.9.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.5build1","21.12","21.13","21.14","21.14.1","21.15","21.16","22.1","22.2","22.3","22.4","22.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.15","23.19","24.1","24.2","24.3","24.4","24.5","24.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.6","25.9","25.9.1","25.9.2","25.9.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freedombox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.9.3","26.4.2ubuntu1","26.5"]}],"products":[{"vendor":"debian","product":"freedombox"}],"references":[{"url":"https://salsa.debian.org/freedombox-team/freedombox/-/commit/8ba444990b4af6eec4b6b2b26482b107d","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68462"},{"url":"https://github.com/advisories/GHSA-gjwv-45pm-f62j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68462","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68462","tags":["report"]},{"url":"https://salsa.debian.org/freedombox-team/freedombox/-/issues/2554","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-68462","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T05:14:11.92Z","modified":"2025-12-18T18:53:43.177Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-204034","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T05:14:11Z","modified":"2025-12-18T18:53:43Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:03.071772Z"}],"ghsa":[{"id":"GHSA-gjwv-45pm-f62j","title":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory,...","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T06:30:13Z","modified":"2025-12-18T06:30:19Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:05:16.313648Z"}],"nvd":[{"id":"CVE-2025-68462","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T06:15:50.007Z","modified":"2026-06-17T09:59:06.423Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"DEBIAN-CVE-2025-68462","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T06:15:50.007Z","modified":"2026-09-01T20:05:57.564270749Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-68462","description":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","status":"published","published":"2025-12-18T06:15:00Z","modified":"2026-05-20T16:23:45.360789153Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:52.345622Z"}]}}