CVE-2025-54867

Published: Aug 14, 2025Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.

Affected (1)

Products: Youki Dev: Youki

Youki Dev

1 product

Youki

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Youki Dev Youki	Before 0.5.5

Related CWEs

CWE-61

UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

References (3)

https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37

Source: security-advisories@github.com

Patch

https://github.com/youki-dev/youki/releases/tag/v0.5.5

Source: security-advisories@github.com

Release Notes

https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.