nfpm vulnerable to Incorrect Default Permissions

## Vulnerability nFPM, a packaging tool alternative to fpm, does not maintain file permissions when building packages directly from source control. Without explicit configuration to enforce permissions, source files with overly broad permissions (such as 666 or 777) are passed into the final package unchanged [1][2].

Exploitation

An attacker who can contribute files to a source repository used by nFPM can set those files to world-writable permissions. When nFPM packages the repository using default settings, the resulting package installs those files with the same dangerous permissions on the target system. No special authentication or network position is required; the attack surface is limited to scenarios where untrusted files are added to a repository that is then packaged without permission overrides [2].

Impact

Systems that install packages created by nFPM may end up with executable scripts or configuration files that are writable by any user (chmod 666 or 777). This can lead to privilege escalation, unauthorized modification of system files, or other security breaches, depending on the location and content of the affected files [1][2].

Mitigation

The vulnerability is fixed in nFPM version 2.29.0 [3]. Users should upgrade to this version or later. Alternatively, packagers can explicitly specify file permissions in the nFPM configuration to override source permissions. There is no workaround if the source files already have dangerous permissions and the configuration does not enforce correct permissions [2].