CVE-2025-14575

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

CVSS

No CVSS.

References

Link	Resource
https://codereview.qt-project.org/c/qt/qtbase/+/642967

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Elemento de Ruta de Búsqueda No Controlada en el backend TLS de OpenSSL de Qt Network (qtbase) en Qt Qt Framework (Unix) permite a un atacante local cargar un certificado de CA malicioso como una autoridad de sistema de confianza a través de un archivo de certificado manipulado colocado en el directorio de trabajo de la aplicación.

Information

Published : 2026-05-19 14:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-14575

Mitre link : CVE-2025-14575

CVE.ORG link : CVE-2025-14575

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-14575", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14575", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T14:10:44.802040Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "affectedData": [{"repo": "https://code.qt.io/cgit/qt/qtbase.git", "vendor": "Qt", "modules": ["QSslCertificate", "QTlsBackendOpenSSL"], "product": "Qt", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "python", "lessThanOrEqual": "5.15.19"}, {"status": "affected", "version": "6.0.0", "versionType": "python", "lessThanOrEqual": "6.5.9"}, {"status": "affected", "version": "6.6.0", "versionType": "python", "lessThanOrEqual": "6.8.3"}, {"status": "affected", "version": "6.9.0", "versionType": "python", "lessThanOrEqual": "6.9.1"}], "platforms": ["Linux", "Unix"], "packageName": "qtbase", "collectionURL": "https://www.qt.io/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T14:16:27.120", "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/642967", "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory."}, {"lang": "es", "value": "Una vulnerabilidad de Elemento de Ruta de B\u00fasqueda No Controlada en el backend TLS de OpenSSL de Qt Network (qtbase) en Qt Qt Framework (Unix) permite a un atacante local cargar un certificado de CA malicioso como una autoridad de sistema de confianza a trav\u00e9s de un archivo de certificado manipulado colocado en el directorio de trabajo de la aplicaci\u00f3n."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}