Low severity · published Dec 18, 2025
CVE-2025-68462
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases
3.2
CVSS
0.1%
EPSS
No
On KEV
Description
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
FreedomBox · Debian
before 25.17.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68462
salsa.debian.org
https://salsa.debian.org/freedombox-team/freedombox/-/commit/8ba444990b4af6eec4b6b2b26482b107d
More from FreedomBox
5.3
CVE-2020-25073
FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion…