CVE-2025-46717: sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders
First published: Mon May 12 2025(Updated: )
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| sudo-rs | <0.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46717?
CVE-2025-46717 is categorized as a potential security risk due to unauthorized file access capabilities for users with limited sudo privileges.
How do I fix CVE-2025-46717?
To remediate CVE-2025-46717, upgrade sudo-rs to version 0.2.6 or later.
Who is affected by CVE-2025-46717?
CVE-2025-46717 affects users of sudo-rs versions prior to 0.2.6.
What systems are vulnerable to CVE-2025-46717?
Any systems running versions of sudo-rs before 0.2.6 are vulnerable to CVE-2025-46717.
What is the nature of the vulnerability in CVE-2025-46717?
CVE-2025-46717 allows users with limited sudo privileges to ascertain the presence of files in directories they cannot access.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/sudo-rs
- canonical/sudo-rs