CVE-2025-64343

(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.

• CWE-289

• https://github.com/conda/constructor/commit/c368383710a7c2b81ad1b0ecb9724b38d3577447
• https://github.com/conda/constructor/releases/tag/3.13.0
• https://github.com/conda/constructor/security/advisories/GHSA-vvpr-2qg4-2mrq

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64336ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-64338ClipBucket v5 is an open source video sharing platform. In v…9
• CVE-2025-64339ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-6434The exception page for the HTTPS-Only feature, displayed whe…4.3
• CVE-2025-64340FastMCP is the standard framework for building MCP applicati…7.8
• CVE-2025-64342ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.9
• CVE-2025-64344Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64345Wasmtime is a runtime for WebAssembly. Prior to version 38.0…1.8
• CVE-2025-64346archives is a Go library for extracting archives (tar, zip, …6
• CVE-2025-64347Apollo Router Core is a configurable Rust graph router writt…7.5
• CVE-2025-64348ELOG allows an authenticated user to modify or overwrite the…7.1
• CVE-2025-64349ELOG allows an authenticated user to modify another user's p…8.8