Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2025-3908

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the o

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
OpenVPN

Description

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenVPN OpenVPN 3 Linux

Default version status: unaffected

  • v20 to ≤ v24affected

References