Moderate severityOSV Advisory· Published Jan 23, 2026· Updated Jan 23, 2026
CVE-2025-67124
CVE-2025-67124
Description
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
miniservecrates.io | < 0.32.0 | 0.32.0 |
Affected products
2Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.