Medium severity6.8OSV Advisory· Published Jan 23, 2026· Updated Jun 17, 2026

CVE-2025-67124

Description

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
miniservecrates.io	< 0.32.0	0.32.0

Affected products

Svenstaro/MiniserveOSV2 versions
v0.1, v0.1.1, v0.1.2, …+ 1 more
- (no CPE)range: v0.1, v0.1.1, v0.1.2, …
- cpe:2.3:a:svenstaro:miniserve:0.32.0:*:*:*:*:*:*:*
ghsa-coords
pkg:cargo/miniserve
Range: < 0.32.0

Patches

Vulnerability mechanics

References

gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63fnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-mxc8-4jqf-368qghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-67124ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000