Directory Permission Vulnerability in Dragonfly P2P File Distribution Software

CVE-2025-59349

What is CVE-2025-59349?

Dragonfly, an open-source P2P file distribution and image acceleration system, is susceptible to a directory permission vulnerability. This flaw occurs in versions prior to 2.1.0, where the os.MkdirAll function is utilized to create directory paths without adequately checking existing permissions. A local attacker could leverage this oversight to establish a directory with improper permissions, allowing for potential modifications or tampering with files intended for Dragonfly use. The vulnerability has been addressed in version 2.1.0, making it crucial for users to upgrade to this version to mitigate risk.

References