CVE-2025-3155 Yelp: arbitrary file read
Malicious help documents in Yelp can execute scripts to exfiltrate user files, requiring patches for Red Hat and other Linux distributions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-3155?
CVE-2025-3155 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 3 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Weakness: CWE-601
Which versions are affected by CVE-2025-3155?
It affects 21 products.
Linux distribution packages (40)
yelp AlmaLinux:8 | All versions | 2:3.28.1-3.el8_10.1 |
yelp-devel AlmaLinux:8 | All versions | 2:3.28.1-3.el8_10.1 |
yelp-libs AlmaLinux:8 | All versions | 2:3.28.1-3.el8_10.1 |
yelp-xsl AlmaLinux:8 | All versions | 3.28.0-2.el8_10.1 |
yelp AlmaLinux:9 | All versions | 2:40.3-2.el9_6.1 |
yelp-devel AlmaLinux:9 | All versions | 2:40.3-2.el9_6.1 |
yelp-libs AlmaLinux:9 | All versions | 2:40.3-2.el9_6.1 |
yelp Red Hat:enterprise_linux:8::appstream | All versions | 2:3.28.1-3.el8_10.1 |
yelp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 2:3.28.1-3.el8_10.1 |
yelp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 2:3.28.1-3.el8_10.1 |
yelp-libs Red Hat:enterprise_linux:8::appstream | All versions | 2:3.28.1-3.el8_10.1 |
yelp-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 2:3.28.1-3.el8_10.1 |
yelp-xsl Red Hat:enterprise_linux:8::appstream | All versions | 0:3.28.0-2.el8_10.1 |
yelp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 2:3.28.1-3.el8_10.1 |
yelp-debugsource Red Hat:enterprise_linux:8::crb | All versions | 2:3.28.1-3.el8_10.1 |
yelp-devel Red Hat:enterprise_linux:8::crb | All versions | 2:3.28.1-3.el8_10.1 |
yelp-libs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 2:3.28.1-3.el8_10.1 |
yelp Red Hat:enterprise_linux:9::appstream | All versions | 2:40.3-2.el9_6.1 |
yelp-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:40.3-2.el9_6.1 |
yelp-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:40.3-2.el9_6.1 |
yelp-libs Red Hat:enterprise_linux:9::appstream | All versions | 2:40.3-2.el9_6.1 |
yelp-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:40.3-2.el9_6.1 |
yelp-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:40.3-2.el9_6.1 |
yelp-debugsource Red Hat:enterprise_linux:9::crb | All versions | 2:40.3-2.el9_6.1 |
yelp-devel Red Hat:enterprise_linux:9::crb | All versions | 2:40.3-2.el9_6.1 |
yelp-libs-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:40.3-2.el9_6.1 |
yelp Red Hat:rhel_aus:8.2::appstream | All versions | 2:3.28.1-3.el8_2.1 |
yelp-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 2:3.28.1-3.el8_2.1 |
yelp-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 2:3.28.1-3.el8_2.1 |
yelp-libs Red Hat:rhel_aus:8.2::appstream | All versions | 2:3.28.1-3.el8_2.1 |
yelp-libs-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 2:3.28.1-3.el8_2.1 |
yelp Red Hat:rhel_aus:8.4::appstream | All versions | 2:3.28.1-3.el8_4.1 |
yelp-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 2:3.28.1-3.el8_4.1 |
yelp-debugsource Red Hat:rhel_aus:8.4::appstream | All versions | 2:3.28.1-3.el8_4.1 |
yelp-libs Red Hat:rhel_aus:8.4::appstream | All versions | 2:3.28.1-3.el8_4.1 |
yelp-libs-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 2:3.28.1-3.el8_4.1 |
yelp Red Hat:rhel_aus:8.6::appstream | All versions | 2:3.28.1-3.el8_6.1 |
yelp-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 2:3.28.1-3.el8_6.1 |
yelp-debugsource Red Hat:rhel_aus:8.6::appstream | All versions | 2:3.28.1-3.el8_6.1 |
yelp-libs Red Hat:rhel_aus:8.6::appstream | All versions | 2:3.28.1-3.el8_6.1 |
Products include Debian Debian Linux, Gnome Yelp, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder for Arm64, Redhat Codeready Linux Builder for Arm64 Eus, Redhat Codeready Linux Builder for Eus and 15 more.
How do I fix CVE-2025-3155?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-3155 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3155 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2025:7430, ALSA-2025:7569, CLSA-2025-1750782430, CLSA-2026-1791305273, DEBIAN-CVE-2025-3155, DLA-4184-1 and 32 more.