CVE-2025-67124

PoC —

CVSS 3.1

6.8 medium

EPSS

<1%p24

Published

Jan 23, 2026 (Jan 23, 2026)

Modified

Jun 17, 2026

Description

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

Vendors: svenstaro
Products: miniserve
Weakness: CWE-59, CWE-367
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.