CVE-2025-3908

EUVD-2025-15743
The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.88%
Affected Products (NVD)
VendorProductVersion
openvpnopenvpn3linux
20 ≤
𝑥
≤ 24
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openvpn3-client
forky
27.1+dfsg-2
fixed
sid
27.1+dfsg-2
fixed
trixie
24.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openvpn3-client
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
ignored
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://community.openvpn.net/Security%20Announcements/CVE-2025-3908
http://www.openwall.com/lists/oss-security/2025/05/20/2