CVE-2025-24965CWE-22

.krun_config.json symlink attack creates or overwrites file on the host in crun

High · published February 19, 2025

CVSS v4.0
8.5
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00577 · 46.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-19T16:46Z
EPSS history
Timeline
  • 19 FEB 16:46Z
    .krun_config.json symlink attack creates or overwrites file on the host in crun
    cvelistv5