CVE-2025-3155: Yelp: arbitrary file read
First published: Thu Apr 03 2025(Updated: )
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Yelp | ||
| debian/yelp | <=3.38.3-1<=42.2-1 | 42.2-3 42.2-4 |
| debian/yelp-xsl | <=3.38.3-1<=42.1-2 | 42.1-4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2025-3155
- https://bugzilla.redhat.com/show_bug.cgi?id=2357091
- http://www.openwall.com/lists/oss-security/2025/04/04/1
- https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2
- https://blogs.gnome.org/mcatanzaro/2025/04/15/dangerous-arbitrary-file-read-vulnerability-in-yelp-cve-2025-3155/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3155
- https://nvd.nist.gov/vuln/detail/CVE-2025-3155
- https://launchpad.net/bugs/cve/CVE-2025-3155
- https://security-tracker.debian.org/tracker/CVE-2025-3155
- https://ubuntu.com/security/CVE-2025-3155
- https://www.openwall.com/lists/oss-security/2025/04/04/1
- https://gitlab.gnome.org/GNOME/yelp/-/issues/221
Frequently Asked Questions
What is the severity of CVE-2025-3155?
CVE-2025-3155 is classified as a high-severity vulnerability due to the potential for arbitrary script execution.
How do I fix CVE-2025-3155?
To fix CVE-2025-3155, update the Yelp application to the latest version that addresses this vulnerability.
What type of vulnerabilities are associated with CVE-2025-3155?
CVE-2025-3155 is associated with code injection and arbitrary file access vulnerabilities.
Who is affected by CVE-2025-3155?
Users of the GNOME Yelp application are affected by CVE-2025-3155.
What can attackers achieve with CVE-2025-3155?
Attackers can execute arbitrary scripts, potentially exfiltrating user files to an external environment.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-3155
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-cve
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- vendor/gnome
- canonical/yelp
- package-manager/debian