CVE-2025-34075

RubyGems/vagrant CVE-2025-34075: medium

HashiCorp Vagrant has code injection vulnerability through default synced folders

Action: Upgrade vagrant to 2.4.7 or later.

bundle update vagrant

Affected

Fixed versions

Sources

• osv: GHSA-hqp6-mjw3-f586
• https://nvd.nist.gov/vuln/detail/CVE-2025-34075
• https://github.com/hashicorp/vagrant/issues/13688
• https://github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3
• https://developer.hashicorp.com/vagrant
• https://developer.hashicorp.com/vagrant/docs/synced-folders/basic_usage
• https://developer.hashicorp.com/vagrant/docs/vagrantfile
• https://github.com/advisories/GHSA-hqp6-mjw3-f586
• https://github.com/hashicorp/vagrant
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/vagrant/CVE-2025-34075.yml
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb
• https://vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout

CVE-2025-34075 · published 2025-07-02T21:32:00Z · modified 2025-07-05T02:25:30.297787Z · JSON