CVE-2025-64184

Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). This issue is fixed in version 3.2.

• CWE-22

• https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e
• https://github.com/webcomics/dosage/security/advisories/GHSA-4vcx-3pj3-44m7

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64179lakeFS is an open-source tool that transforms object storage…5.3
• CVE-2025-6418A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64180Manager-io/Manager is accounting software. In Manager Deskto…10
• CVE-2025-64181OpenEXR provides the specification and reference implementat…7.5
• CVE-2025-64182OpenEXR provides the specification and reference implementat…7.8
• CVE-2025-64183OpenEXR provides the specification and reference implementat…7.5
• CVE-2025-64185Open OnDemand is an open-source HPC portal. Prior to version…6.9
• CVE-2025-64186Evervault is a payment security solution. A vulnerability wa…6.5
• CVE-2025-64187OctoPrint provides a web interface for controlling consumer …4.4
• CVE-2025-64188Incorrect Privilege Assignment vulnerability in PenciDesign …9.8
• CVE-2025-64189Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-6419A vulnerability was found in code-projects Simple Online Hot…9.8