Directory Permission Vulnerability in Dragonfly P2P File Distribution Software
CVE-2025-59349

2LOW

Key Information:

Vendor

Dragonflyoss

Status
Dragonfly
Vendor
CVE Published:
17 September 2025

What is CVE-2025-59349?

Dragonfly, an open-source P2P file distribution and image acceleration system, is susceptible to a directory permission vulnerability. This flaw occurs in versions prior to 2.1.0, where the os.MkdirAll function is utilized to create directory paths without adequately checking existing permissions. A local attacker could leverage this oversight to establish a directory with improper permissions, allowing for potential modifications or tampering with files intended for Dragonfly use. The vulnerability has been addressed in version 2.1.0, making it crucial for users to upgrade to this version to mitigate risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

dragonfly < 2.1.0

References

https://github.com/dragonflyoss/dragonfly/security/adviso...
x_refsource_CONFIRM
https://github.com/dragonflyoss/dragonfly/blob/main/docs/...
x_refsource_MISC

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.