CVE-2025-54867CWE-61

Youki Symlink Following Vulnerability

High · published August 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2025-08-14T16:08Z
EPSS history
Timeline
  • 14 AUG 16:08Z
    Youki Symlink Following Vulnerability
    cvelistv5