{"id":"UBUNTU-CVE-2025-46415","details":"A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","modified":"2026-09-16T20:22:52.315068802Z","published":"2025-06-27T14:15:00Z","upstream":["CVE-2025-46415"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-46415"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-46415"},{"type":"REPORT","url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/pulls/788"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/be8aca065118aa4485c02f991c51bea89034defa"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/c659f977bb09de6d5615e6aa9efddedc1d9ff458"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/0e79d5b6550729e6ce3bac1e979638ac054ba5a5"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde"}],"affected":[{"package":{"name":"guix","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/guix?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4","1.3.0-4ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"guix","binary_version":"1.3.0-4ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-46415.json"}},{"package":{"name":"guix","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/guix?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-5","1.4.0-6","1.4.0-6build1","1.4.0-6ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"guix","binary_version":"1.4.0-6ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-46415.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"},{"type":"Ubuntu","score":"medium"}]}