CVE-2025-32802: isc kea External Control of File Name or Path
Vulnerability summary
CVE-2025-32802 is a medium (CVSS 6.1) External Control of File Name or Path vulnerability in isc kea. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 28-05-2025PublishedVulnerability first disclosed.
- 28-05-2025Last modifiedVulnerability information updated.
Description
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- NVDNIST6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.01 pp
From 0.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-379Creation of Temporary File in Directory with Insecure PermissionsThe product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Affected systems
Alpine1 product
- kea< 2.6.3-r0
Debian1 product
- isc-keaAll versions (No fix recorded) | < 2.6.3-1
Isc1 product
- kea≥ 2.4.0, ≤ 2.4.1 | ≥ 2.6.0, ≤ 2.6.2 | ≥ 2.7.0, ≤ 2.7.8
Ubuntu1 product
- isc-keaAll versions (No fix recorded) | < 2.6.3-1
4 vendors · 4 products
References
7 links- kb.isc.org/docs/cve-2025-32802Vendor Advisory
