CVE search · CVE-2025-3908

CVE-2025-3908

medium 6.2

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2025-05-19
Last changed: 2026-06-17
Source: security@openvpn.net
Weakness: CWE-59

Severity

Version	Score	Vector	Source
CVSS 3.1	medium 6.2	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

openvpn · openvpn3linux

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-3908Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/20/2Mailing List

CVE-2025-3908

Details

Severity

Affected products

References