{"action":"Upgrade diffoscope to 256 or later.","affected":[{"fixed":"256","introduced":"0"}],"component":"diffoscope","cve_ids":["CVE-2024-25711"],"ecosystem":"PyPI","epss":0.00987,"exploited":false,"fixed_versions":["256"],"ghsa_id":"GHSA-33w6-hvmq-gh4x","id":"tcs_01M5KGN7PMVMFBNTXET302GDFG","modified_at":"2026-06-10T17:00:45.002468596Z","published_at":"2024-02-27T02:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-41","https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361","https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/","https://github.com/advisories/GHSA-33w6-hvmq-gh4x"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-41","url":"https://osv.dev/vulnerability/PYSEC-2024-41"}],"summary":"diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of"}