{"id":"EUVD-2025-37938","revision":"d6f12a75eb6d4ed694a5eb91c8ec1d14","records":[{"revision":"d6f12a75eb6d4ed694a5eb91c8ec1d14","observedAt":"2026-11-03T02:06:37.518+00:00","statement":{"source":"euvd","id":"EUVD-2025-37938","aliases":["CVE-2025-62596","GHSA-vf95-55w6-qmrf"],"title":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writ…","description":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":7.3,"severity":null}],"references":["https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf","https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a","https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs","https://youtu.be/tGseJW_uBB8","https://youtu.be/y1PaBzxwRWQ"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-37938","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 5, 2025, 11:14:37 PM","dateUpdated":"Nov 6, 2025, 4:54:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-37938","identifiers":["EUVD-2025-37938","CVE-2025-62596","GHSA-vf95-55w6-qmrf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}