CVE-2025-46717lowCWE-497

CVE-2025-46717: low-severity vulnerability in trifectatechfoundation sudo-rs

sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

Published

Follow this CVE+ Monitor sudo-rs+ Monitor sudo-rs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.3epss 0.4%
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
trifectatechfoundation · sudo-rs
Related CVEs — trifectatechfoundation sudo-rs

In the same product, most dangerous first.

CVE-2025-46718LOWsudo-rs Allows Low Privilege Users to Enumerate Privileges of OthersEPSS 0.3%CVE-2025-64517MEDIUMsudo-rs doesn't record authenticating user properly in timestampEPSS 0.2%CVE-2025-64170LOWsudo-rs: Partial password reveal is possible after timeoutEPSS 0.1%