File Modification Vulnerability in YAML-LibYAML for Perl
CVE-2025-40908

9.1CRITICAL

Key Information:

Vendor

Tinita

Status
Yaml::libyaml
Vendor
CVE Published:
1 June 2025

What is CVE-2025-40908?

The YAML-LibYAML for Perl prior to version 0.903.0 contains a vulnerability that permits unauthorized modification of existing files due to the use of two-argument open calls. This flaw exposes users to potential data corruption and unauthorized file alterations.

Affected Version(s)

YAML::LibYAML 0 < 0.903.0

References

https://github.com/ingydotnet/yaml-libyaml-pm/issues/120
issue-tracking
https://github.com/ingydotnet/yaml-libyaml-pm/pull/121
patch
https://github.com/ingydotnet/yaml-libyaml-pm/pull/122
patch

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@shlomif (Shlomi Fish)
.
CVE-2025-40908 : File Modification Vulnerability in YAML-LibYAML for Perl