CVE-2022-25328: google llc fscrypt OS Command Injection
Vulnerability summary
CVE-2022-25328 is a high (CVSS 7.3) OS Command Injection vulnerability in google llc fscrypt. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 25-02-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- fscrypt< 0.3.3-1
Github.com/google1 product
- fscrypt< 0.3.3
Google1 product
- fscrypt< 0.3.3
Google llc1 product
- fscrypt≥ unspecified, ≤ 0.3.2
Ubuntu1 product
- fscrypt< 0.3.3-1
5 vendors · 5 products
