Skip to main content

Ubuntu CVE-2025-53075

| EUVDEUVD-2025-19504 CRITICAL
Improper Input Validation (CWE-20)
2025-06-30 PSIRT@samsung.com
Samsung Path Traversal Ubuntu Debian Rlottie
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Low–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 16, 2026 - 01:25 euvd
EUVD-2025-19504
Analysis Generated
Mar 16, 2026 - 01:25 vuln.today
CVE Published
Jun 30, 2025 - 02:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.

Analysis

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Rlottie

View all
CVE-2025-53076 CRITICAL
9.8 Jun 30

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti
CVE-2025-0634 CRITICAL
9.8 Jun 30

Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.
CVE-2025-53074 CRITICAL
9.1 Jun 30

Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2
CVE-2026-15551 MEDIUM
5.5 Jul 13

Integer overflow in Samsung's open-source rlottie animation rendering library leads to buffer overflow, with high availa

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Vendor StatusVendor

Ubuntu

Priority: Low
rlottie
Release Status Version
plucky ignored end of life, was needs-triage
focal released 0~git20200305.a717479+dfsg-1ubuntu0.1~esm2
jammy released 0.1+dfsg-2ubuntu0.2
noble released 0.1+dfsg-4ubuntu1.1
oracular ignored end of life, was needs-triage
questing released 0.1+dfsg-4.2ubuntu0.1
upstream released -
USN-8058-1

Debian

Bug #1109341
rlottie
Release Status Fixed Version Urgency
bullseye fixed 0.1+dfsg-2+deb11u1 -
bullseye (security) fixed 0.1+dfsg-2+deb11u1 -
bookworm fixed 0.1+dfsg-4+deb12u1 -
trixie fixed 0.1+dfsg-4.2+deb13u1 -
forky, sid fixed 0.1+dfsg-4.3 -
(unstable) fixed 0.1+dfsg-4.3 -
DLA-4474-1

Share

CVE-2025-53075 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy