What is the CVSS score of CVE-2025-49466?

CVE-2025-49466 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Ubuntu are affected by CVE-2025-49466?

Organizations using aerc before 93bec0d should be aware of moderate risk from CVE-2025-49466 rated CVSS 5.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-49466?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ubuntu CVE-2025-49466

EUVD-2025-16956 MEDIUM

Relative Path Traversal (CWE-23)

2025-06-05 cve@mitre.org

Path Traversal Ubuntu Debian Suse

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Ubuntu

MEDIUM

qualitative

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16956

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

CVE Published

Jun 05, 2025 - 03:15 nvd

MEDIUM 5.8

DescriptionCVE.org

aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,

Analysis

aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

Same weakness CWE-23 – Relative Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2024-27199 HIGH POC

7.3

CVE-2025-34510 HIGH POC

8.8

CVE-2026-34926 MEDIUM POC

6.7

CVE-2024-24578 CRITICAL POC

9.8

CVE-2025-52207 CRITICAL POC

9.9

CVE-2023-6825 CRITICAL POC

9.9

CVE-2022-1373 HIGH POC

7.2

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

Vendor StatusVendor

Ubuntu

Priority: Medium

aerc

Release	Status	Version
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

aerc

Release	Status	Fixed Version	Urgency
bookworm	not-affected	-	-
trixie	fixed	0.20.0-2	-
forky, sid	fixed	0.21.0-2	-
(unstable)	fixed	0.20.0-2	-

SUSE

Severity: Medium

CVE-2025-49466 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-49466

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-23 – Relative Path Traversal

Same technique Path Traversal

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code