VULNERABILITY INTELLIGENCE
CVE-2025-59378
CVSS score5.7 MEDIUM
EPSS probability0.14%
CISA KEVNot currently listed
Published2025-09-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Description
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
Weakness classification
- cve@mitre.org: CWE-669