{"id":"CVE-2025-0781","summary":"Incorrect Authorization in SimGear","details":"An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.","modified":"2026-08-12T15:16:13.683295Z","published":"2025-01-28T16:34:21.881Z","database_specific":{"cna_assigner":"GitLab","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0781.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00028.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00029.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0781.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0781"},{"type":"REPORT","url":"https://gitlab.com/flightgear/flightgear/-/issues/3025"},{"type":"FIX","url":"https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358"},{"type":"FIX","url":"https://gitlab.com/flightgear/simgear/-/commit/5bb023647114267141a7610e8f1ca7d6f4f5a5a8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/flightgear/flightgear","events":[{"introduced":"0"},{"fixed":"ad37afce28083fad7f79467b3ffdead753584358"}],"database_specific":{"cpe":"cpe:2.3:a:flightgear:simgear:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2020.3.19"}],"source":["CPE_RANGE","REFERENCES"]}},{"type":"GIT","repo":"https://gitlab.com/flightgear/simgear","events":[{"introduced":"0"},{"fixed":"5bb023647114267141a7610e8f1ca7d6f4f5a5a8"}],"database_specific":{"source":"REFERENCES"}}],"versions":["JSBSim/v1.1.1","version/2018.2.1","version/2018.3.0","version/2018.1.1","version/2018.2.0","version/2017.3.1","version/2017.4.0","version/2017.2.1","version/2017.3.0","version/2017.1.1","version/2017.2.0","version/2016.3.1","version/2016.4.0","version/2016.2.1","version/2016.3.0","version/2016.1.1","version/2016.2.0","version/2016.1.0","version/3.7.0","version/3.6.0","version/3.4.0","version/3.5.0","version/3.3.0","version/3.2.0","remove-ATCDCL","version/3.1.0","version/3.0.0","version/2.12.0","version/2.11.0","version/2.10.0","version/2.9.0","version/2.8.0","version/2.6.0","version/2.7.0","2.2.0-rc1","last-cvs","v2.0.0","v2.0.0-rc4","v2.0.0-rc3","master-20100125","v2.0.0-rc2","master-20100117","v2.0.0-rc1","version/2016.4.1","version/2017.1.0","version/2.10.0-final","SIMGEAR_1_9_0","Release-1999_05_01","AFTER_OPENAL_DOPPLER_WORKAROUND","BEFORE_OPENAL_DOPPLER_WORKAROUND","sm-lastmain","PRE_OSG_PLIB_BPOINT","RELEASE_0_3_10","RELEASE_0_3_9","RELEASE_0_3_8","RELEASE_0_3_7","RELEASE_0_3_6","RELEASE_0_3_5","RELEASE_0_3_5_pre2","RELEASE_0_3_5_pre1","RELEASE_0_3_4","RELEASE_0_3_4_pre1","RELEASE_0_3_3","RELEASE_0_3_2","RELEASE_0_3_1","RELEASE_0_3_0","RELEASE_0_2_0","RELEASE_0_0_19pre2","RELEASE_0_0_19pre1","RELEASE_0_0_18","RELEASE_0_0_17","RELEASE_0_0_16","RELEASE_0_0_15","RELEASE_0_0_14","RELEASE_0_0_13","RELEASE_0_0_12","RELEASE_0_0_11","RELEASE_0_7_3","RELEASE_0_0_7","RELEASE_0_0_6","RELEASE_0_7_2","RELEASE_0_6_2","RELEASE_0_6_1","RELEASE_0_6_0","RELEASE_0_59","RELEASE_0_58","RELEASE_0_57"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0781.json","vanir_signatures_modified":"2026-08-12T15:16:13Z","vanir_signatures":[{"id":"CVE-2025-0781-1eb9661d","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/flightgear/flightgear@ad37afce28083fad7f79467b3ffdead753584358","target":{"file":"src/Scripting/NasalSGPath.cxx"},"deprecated":false,"digest":{"line_hashes":["287558192824168312176891526790588496326","225277196899202221484671989223216982661","97977021556137033147410305547317865985","15452191806764509888845595507775211228","218372333113441929091944420501057161656","197289599082844171290506947691576468269","188572630938096942081350278361378026228","82750131224663590802561524734000195216","286647616246624700125669281790932041499","20085596970029472661381297419955388801","167393378517571835829488279623996957397","112425518745368565899588644987679926978","136792069286970499323062558466422699331","271212504417626079067349643145180240459","119113019396989550235112541028399600526","292433013028081855349094781587969332439","18377852305958671715945432507043452972","119253018290270376766464903124617177530","299115726733373068994629636046039861704","322048486035876141469231256591019114767","309149560221026940696098734283161745184","295898540188440883117189237753632757596","306296572503005881132392319214469943585"],"threshold":0.9}},{"signature_version":"v1","source":"https://gitlab.com/flightgear/flightgear@ad37afce28083fad7f79467b3ffdead753584358","target":{"file":"src/Scripting/NasalSGPath.cxx","function":"checkIORules"},"deprecated":false,"digest":{"function_hash":"281077675152790947644426163833833883594","length":474},"id":"CVE-2025-0781-4b74dda3","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"192516153807057495305720056885075134724","length":178},"id":"CVE-2025-0781-4fc6021c","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/flightgear/simgear@5bb023647114267141a7610e8f1ca7d6f4f5a5a8","target":{"file":"simgear/nasal/cppbind/detail/from_nasal_helper.cxx","function":"from_nasal_helper"}},{"deprecated":false,"digest":{"line_hashes":["209304454616588305242003159985146152025","133584376709863715448258060440547759566","176419921888979942730186722903714587854"],"threshold":0.9},"id":"CVE-2025-0781-5ec40270","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/flightgear/simgear@5bb023647114267141a7610e8f1ca7d6f4f5a5a8","target":{"file":"simgear/misc/sg_path.cxx"}},{"id":"CVE-2025-0781-9afb2afc","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/flightgear/flightgear@ad37afce28083fad7f79467b3ffdead753584358","target":{"file":"src/Scripting/NasalSGPath.cxx","function":"validatedPathToNasal"},"deprecated":false,"digest":{"function_hash":"61856522253849571751186914217369993848","length":165}},{"deprecated":false,"digest":{"function_hash":"170458705050771857603730969025994986495","length":131},"id":"CVE-2025-0781-9e20b9d2","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/flightgear/flightgear@ad37afce28083fad7f79467b3ffdead753584358","target":{"function":"f_desktop","file":"src/Scripting/NasalSGPath.cxx"}},{"deprecated":false,"digest":{"line_hashes":["191177096978102545166284114464431415000","311168252081431369544220230255347480265","21135368358186218003915184244009766713"],"threshold":0.9},"id":"CVE-2025-0781-abe9f4b1","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/flightgear/simgear@5bb023647114267141a7610e8f1ca7d6f4f5a5a8","target":{"file":"simgear/misc/sg_path.hxx"}},{"deprecated":false,"digest":{"line_hashes":["133436955740997285381001568351045259426","317849807320933944258474254794733096036","317610975035575883086532795485539936851","56346657599806778158543148933079470569"],"threshold":0.9},"id":"CVE-2025-0781-c7d15254","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/flightgear/simgear@5bb023647114267141a7610e8f1ca7d6f4f5a5a8","target":{"file":"simgear/nasal/cppbind/detail/from_nasal_helper.cxx"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}