High severity8.7OSV Advisory· Published Apr 4, 2025· Updated Apr 15, 2026

CVE-2025-32111

Description

The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Acmesh Official/Acme.shOSV2 versions
1.2.2, 1.2.3, 2.0.2, …+ 1 more
- (no CPE)range: 1.2.2, 1.2.3, 2.0.2, …
- (no CPE)range: < 40b6db6

Patches

Vulnerability mechanics

References

github.com/acmesh-official/acme.sh/commit/40b6db6a2715628aa977ed1853fe5256704010aenvd
github.com/acmesh-official/acme.sh/commit/a1de13657e79c5471dbc8fa3539ea39160937389nvd
github.com/actions/checkout/blob/85e6279cec87321a52edac9c87bce653a07cf6c2/README.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000