{"id":"DEBIAN-CVE-2025-68462","details":"Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.","modified":"2026-09-01T20:05:57.564270749Z","published":"2025-12-18T06:15:50.007Z","upstream":["CVE-2025-68462"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-68462"}],"affected":[{"package":{"name":"freedombox","ecosystem":"Debian:12","purl":"pkg:deb/debian/freedombox?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.10","23.11","23.12","23.12~bpo12+1","23.13","23.13~bpo12+1","23.14","23.14~bpo12+1","23.15","23.15~bpo12+1","23.16","23.16~bpo12+1","23.17","23.17~bpo12+1","23.18","23.18~bpo12+1","23.19","23.19~bpo12+1","23.20","23.20~bpo12+1","23.21","23.21~bpo12+1","23.6.2","23.6.2+deb12u1","23.7","23.8","23.9","24.1","24.10","24.10~bpo12+1","24.11","24.11~bpo12+1","24.12","24.12~bpo12+1","24.13","24.13~bpo12+1","24.14","24.14~bpo12+1","24.15","24.15~bpo12+1","24.16","24.16~bpo12+1","24.17","24.17~bpo12+1","24.18","24.18~bpo12+1","24.19","24.1~bpo12+1","24.2","24.20","24.20.1","24.20.1~bpo12+1","24.21","24.21~bpo12+1","24.22","24.22~bpo12+1","24.23","24.23~bpo12+1","24.24","24.24~bpo12+1","24.25","24.25~bpo12+1","24.26","24.26.1","24.26.1~bpo12+1","24.2~bpo12+1","24.3","24.3~bpo12+1","24.4","24.4~bpo12+1","24.5","24.5~bpo12+1","24.6","24.7","24.7~bpo12+1","24.8","24.8~bpo12+1","24.9","24.9~bpo12+1","25.1","25.10","25.10~bpo13+1","25.11","25.11~bpo13+1","25.12","25.12~bpo13+1","25.13","25.13.1","25.13.1~bpo13+1","25.13~bpo13+1","25.14","25.14~bpo13+1","25.15","25.15~bpo13+1","25.16","25.16~bpo13+1","25.17","25.17.1","25.17.1~bpo13+1","25.17~bpo13+1","25.1~bpo12+1","25.2","25.3","25.3.1","25.3.1~bpo12+1","25.4","25.4.1","25.4.1~bpo12+1","25.5","25.5~bpo12+1","25.6","25.6~bpo12+1","25.7","25.7~bpo12+1","25.8","25.8~bpo12+1","25.9","25.9.1","25.9.1~bpo12+1","25.9.2","25.9.2~bpo12+1","25.9.3","25.9.3~bpo12+1","25.9.3~bpo12+2","25.9.4","25.9~bpo12+1","26.1","26.10","26.10~bpo13+1","26.11","26.11.1","26.11.1~bpo13+1","26.1~bpo13+1","26.2","26.2~bpo13+1","26.3","26.4","26.4.1","26.4.2","26.4.2~bpo13+1","26.4~bpo13+1","26.5","26.5.1","26.5.1~bpo13+1","26.6","26.6~bpo13+1","26.7","26.7.1","26.7.1~bpo13+1","26.8","26.8~bpo13+1","26.9","26.9.1","26.9.1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68462.json"}},{"package":{"name":"freedombox","ecosystem":"Debian:13","purl":"pkg:deb/debian/freedombox?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.9.3+deb13u1"}]}],"versions":["25.9.3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68462.json"}},{"package":{"name":"freedombox","ecosystem":"Debian:14","purl":"pkg:deb/debian/freedombox?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.17.1"}]}],"versions":["25.10","25.10~bpo13+1","25.11","25.11~bpo13+1","25.12","25.12~bpo13+1","25.13","25.13.1","25.13.1~bpo13+1","25.13~bpo13+1","25.14","25.14~bpo13+1","25.15","25.15~bpo13+1","25.16","25.16~bpo13+1","25.17","25.17.1~bpo13+1","25.17~bpo13+1","25.9.3","25.9.4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68462.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}