High severity8.7NVD Advisory· Published Apr 4, 2025· Updated Apr 15, 2026

CVE-2025-32111

Description

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.

Patches

40b6db6a2715

https://github.com/acmesh-official/acme.shvia osv

commit

a1de13657e79

https://github.com/acmesh-official/acme.shvia osv

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/acmesh-official/acme.sh/commit/40b6db6a2715628aa977ed1853fe5256704010aenvd
github.com/acmesh-official/acme.sh/commit/a1de13657e79c5471dbc8fa3539ea39160937389nvd
github.com/actions/checkout/blob/85e6279cec87321a52edac9c87bce653a07cf6c2/README.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000