{"id":"GHSA-fq3w-p4fg-mw73","aliases":[],"status":"published","title":"fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`","description":"### Impact\nAffects: Anyone who generates the UNIX man pages in Fuji \u003c= `0.8.0` build with the `dev` crate feature.\nConsequences: `/usr/share/man/man8` may be entirely removed \u0026 re-created without any of the previous entries.\n\n### Patches\nAt the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue.\nDue to the same unrelated publishing issue, no new GitHub Releases version has been released.\n\n### Workarounds\nDo not run `fuji manual` on non-`dev` builds for versions \u003c= `0.8.0`.\n\n### Additional Information\nThis bug results from development-only code being accidentally left in for release use.\nPrevious versions of Fuji are still \"safe\" to use, provided that you do not run `fuji manual`.\nThere is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.","severity":{"version":"4.0","score":1.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-489"],"published":"2026-06-25T18:00:18Z","modified":"2026-06-25T18:15:09Z","fixes":[{"ecosystem":"crates.io","package":"fixurjavainstall","fixed_in":["0.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"fixurjavainstall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.0"},{"fixed":"0.8.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fixurjavainstall","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}]}],"references":[{"url":"https://github.com/EpicVon2468/fixurjavainstall/security/advisories/GHSA-fq3w-p4fg-mw73","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fq3w-p4fg-mw73"},{"url":"https://github.com/EpicVon2468/fixurjavainstall","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fq3w-p4fg-mw73","title":"fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`","description":"### Impact\nAffects: Anyone who generates the UNIX man pages in Fuji \u003c= `0.8.0` build with the `dev` crate feature.\nConsequences: `/usr/share/man/man8` may be entirely removed \u0026 re-created without any of the previous entries.\n\n### Patches\nAt the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue.\nDue to the same unrelated publishing issue, no new GitHub Releases version has been released.\n\n### Workarounds\nDo not run `fuji manual` on non-`dev` builds for versions \u003c= `0.8.0`.\n\n### Additional Information\nThis bug results from development-only code being accidentally left in for release use.\nPrevious versions of Fuji are still \"safe\" to use, provided that you do not run `fuji manual`.\nThere is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.","status":"published","published":"2026-06-25T18:00:18Z","modified":"2026-06-25T18:00:20Z","cvss":[{"version":"4.0","score":1.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-489"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"osv":[{"id":"GHSA-fq3w-p4fg-mw73","title":"fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`","description":"### Impact\nAffects: Anyone who generates the UNIX man pages in Fuji \u003c= `0.8.0` build with the `dev` crate feature.\nConsequences: `/usr/share/man/man8` may be entirely removed \u0026 re-created without any of the previous entries.\n\n### Patches\nAt the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue.\nDue to the same unrelated publishing issue, no new GitHub Releases version has been released.\n\n### Workarounds\nDo not run `fuji manual` on non-`dev` builds for versions \u003c= `0.8.0`.\n\n### Additional Information\nThis bug results from development-only code being accidentally left in for release use.\nPrevious versions of Fuji are still \"safe\" to use, provided that you do not run `fuji manual`.\nThere is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.","status":"published","published":"2026-06-25T18:00:18Z","modified":"2026-06-25T18:15:09.679175008Z","cvss":[{"version":"4.0","score":1.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-489"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}