CVE-2025-62511

{"id": "CVE-2025-62511", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62511", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T20:22:13.089142Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zheny-creator", "product": "YtGrabber-TUI", "versions": [{"status": "affected", "version": "< 1.0.1"}]}]}], "published": "2025-10-17T20:15:42.060", "references": [{"url": "https://github.com/zheny-creator/YtGrabber-TUI/commit/bf065e833820bb4253a70a4c1dc6b843c6d8bf21", "source": "security-advisories@github.com"}, {"url": "https://github.com/zheny-creator/YtGrabber-TUI/security/advisories/GHSA-hwwf-fq6p-rw9q", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "yt-grabber-tui is a C++ terminal user interface application for downloading YouTube content. yt-grabber-tui version 1.0 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) in the creation of the default configuration file config.json. In version 1.0, load_json_settings in Settings.hpp checks for the existence of config.json using boost::filesystem::exists and, if the file is missing, calls create_json_settings which writes the JSON configuration with boost::property_tree::write_json. A local attacker with write access to the application\u2019s configuration directory (~/.config/yt-grabber-tui on Linux or the current working directory on Windows) can create a symbolic link between the existence check and the subsequent write so that the write operation follows the symlink and overwrites an attacker-chosen file accessible to the running process. This enables arbitrary file overwrite within the privileges of the application process, which can corrupt files and cause loss of application or user data. If the application is executed with elevated privileges, this could extend to system file corruption. The issue is fixed in version 1.0.1."}, {"lang": "es", "value": "yt-grabber-tui es una aplicaci\u00f3n de interfaz de usuario de terminal en C++ para descargar contenido de YouTube. yt-grabber-tui versi\u00f3n 1.0 contiene una condici\u00f3n de carrera de Tiempo de Verificaci\u00f3n a Tiempo de Uso (TOCTOU) (CWE-367) en la creaci\u00f3n del archivo de configuraci\u00f3n predeterminado config.json. En la versi\u00f3n 1.0, load_json_settings en Settings.hpp verifica la existencia de config.json usando boost::filesystem::exists y, si el archivo falta, llama a create_json_settings que escribe la configuraci\u00f3n JSON con boost::property_tree::write_json. Un atacante local con acceso de escritura al directorio de configuraci\u00f3n de la aplicaci\u00f3n (~/.config/yt-grabber-tui en Linux o el directorio de trabajo actual en Windows) puede crear un enlace simb\u00f3lico entre la verificaci\u00f3n de existencia y la escritura subsiguiente para que la operaci\u00f3n de escritura siga el enlace simb\u00f3lico y sobrescriba un archivo elegido por el atacante accesible para el proceso en ejecuci\u00f3n. Esto permite la sobrescritura arbitraria de archivos dentro de los privilegios del proceso de la aplicaci\u00f3n, lo que puede corromper archivos y causar la p\u00e9rdida de datos de la aplicaci\u00f3n o del usuario. Si la aplicaci\u00f3n se ejecuta con privilegios elevados, esto podr\u00eda extenderse a la corrupci\u00f3n de archivos del sistema. El problema est\u00e1 solucionado en la versi\u00f3n 1.0.1."}], "lastModified": "2026-10-08T22:10:00.563", "sourceIdentifier": "security-advisories@github.com"}