UNIX Symbolic Link Vulnerability in openSUSE Tumbleweed Traefik2
CVE-2025-46810

8.5HIGH

Key Information:

Vendor

Opensuse
Status
Tumbleweed
Vendor
CVE Published:
2 September 2025

What is CVE-2025-46810?

A vulnerability has been discovered in the packaging of Traefik2 on openSUSE Tumbleweed, allowing for UNIX Symbolic Link (symlink) following. This flaw potentially enables the traefik user to perform unauthorized actions, escalating privileges to the root level. As it affects versions prior to 2.11.29, users of openSUSE Tumbleweed should prioritize applying updates to mitigate the risk of exploitation.

Affected Version(s)

Tumbleweed ? < 2.11.29

References

https://bugzilla.suse.com/show_bug.cgi?id=1245204

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Johannes Segitz of SUSE
.
CVE-2025-46810 : UNIX Symbolic Link Vulnerability in openSUSE Tumbleweed Traefik2