CVE-2025-3908 - AskarLabs CVE Database

CVE-2025-3908

Vendor Openvpn

Product OpenVPN 3 Linux

Weakness CWE-59

Published May 19, 2025

Last update May 20, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Key dates

02Disclosure timeline

May 19, 2025 CVE published

May 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-3908 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/59.html

Related vulnerabilities

04Related CVE

CVE-2026-45539 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree CVE-2023-1314 Local Privilege Escalation Vulnerability in cloudflared's Installer CVE-2022-0017 GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation CVE-2025-53109 Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling CVE-2020-6012