CVE-2025-46717

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.

• CWE-497

• https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6Release Notes
• https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8fExploit, Vendor Advisory
• https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8fExploit, Vendor Advisory

Published

May 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46711Software installed and run as a non-privileged user may cond…5.5
• CVE-2025-46712Erlang/OTP is a set of libraries for the Erlang programming …3.7
• CVE-2025-46713Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46714Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46715Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46716Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
• CVE-2025-46718sudo-rs is a memory safe implementation of sudo and su writt…3.3
• CVE-2025-46719Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2025-4672The Offsprout Page Builder plugin for WordPress is vulnerabl…8.8
• CVE-2025-46720Keystone is a content management system for Node.js. Prior t…4.3
• CVE-2025-46721nosurf is cross-site request forgery (CSRF) protection middl…6.1
• CVE-2025-46722vLLM is an inference and serving engine for large language m…7.3