Go/github.com/dragonflyoss/dragonfly CVE-2025-59349: low 3.3, EPSS 0.12%

Dragonfly's directories created via os.MkdirAll are not checked for permissions

Action: Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.

go get github.com/dragonflyoss/dragonfly@v2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-8425-8r2f-mrv6
• nvd: CVE-2025-59349
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-8425-8r2f-mrv6
• https://github.com/dragonflyoss/dragonfly
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
• https://pkg.go.dev/vuln/GO-2025-3964

CVE-2025-59349 · published 2025-09-17T19:55:25Z · modified 2025-09-26T16:17:33Z · JSON