CVE-2025-54389 AIDE improper output neutralization vulnerability
Attackers can hide file changes in AIDE reports using terminal escape sequences, bypassing intrusion detection mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54389?
CVE-2025-54389 is a medium-severity vulnerability in aide, published on 14 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
Weakness: CWE-117
Which versions are affected by CVE-2025-54389?
It affects 1 product.
Linux distribution packages (40)
aide AlmaLinux:10 | All versions | 0.18.6-8.el10_0.2 |
aide AlmaLinux:8 | All versions | 0.16-15.el8_10.2 |
aide AlmaLinux:9 | All versions | 0.16-103.el9_6.2 |
aide Red Hat:enterprise_linux:10.0 | All versions | 0:0.18.6-8.el10_0.2 |
aide-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:0.18.6-8.el10_0.2 |
aide-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:0.18.6-8.el10_0.2 |
aide Red Hat:enterprise_linux:8::appstream | All versions | 0:0.16-15.el8_10.2 |
aide-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.16-15.el8_10.2 |
aide-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:0.16-15.el8_10.2 |
aide Red Hat:enterprise_linux:9::appstream | All versions | 0:0.16-103.el9_6.2 |
aide-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.16-103.el9_6.2 |
aide-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.16-103.el9_6.2 |
aide Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.16-11.el8_2.2 |
aide-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.16-11.el8_2.2 |
aide-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 0:0.16-11.el8_2.2 |
aide Red Hat:rhel_aus:8.4::appstream | All versions | 0:0.16-14.el8_4.2 |
aide-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:0.16-14.el8_4.2 |
aide-debugsource Red Hat:rhel_aus:8.4::appstream | All versions | 0:0.16-14.el8_4.2 |
aide Red Hat:rhel_aus:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide-debugsource Red Hat:rhel_aus:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide Red Hat:rhel_e4s:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide-debuginfo Red Hat:rhel_e4s:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide-debugsource Red Hat:rhel_e4s:8.6::appstream | All versions | 0:0.16-15.el8_6.1 |
aide Red Hat:rhel_e4s:8.8::appstream | All versions | 0:0.16-15.el8_8.1 |
aide-debuginfo Red Hat:rhel_e4s:8.8::appstream | All versions | 0:0.16-15.el8_8.1 |
aide-debugsource Red Hat:rhel_e4s:8.8::appstream | All versions | 0:0.16-15.el8_8.1 |
aide Red Hat:rhel_e4s:9.0::appstream | All versions | 0:0.16-100.el9_0.1 |
aide-debuginfo Red Hat:rhel_e4s:9.0::appstream | All versions | 0:0.16-100.el9_0.1 |
aide-debugsource Red Hat:rhel_e4s:9.0::appstream | All versions | 0:0.16-100.el9_0.1 |
aide Red Hat:rhel_e4s:9.2::appstream | All versions | 0:0.16-100.el9_2.1 |
aide-debuginfo Red Hat:rhel_e4s:9.2::appstream | All versions | 0:0.16-100.el9_2.1 |
aide-debugsource Red Hat:rhel_e4s:9.2::appstream | All versions | 0:0.16-100.el9_2.1 |
aide Red Hat:rhel_els:7 | All versions | 0:0.15.1-13.el7_9.5 |
aide-debuginfo Red Hat:rhel_els:7 | All versions | 0:0.15.1-13.el7_9.5 |
aide Red Hat:rhel_eus:9.4::appstream | All versions | 0:0.16-100.el9_4.1 |
aide-debuginfo Red Hat:rhel_eus:9.4::appstream | All versions | 0:0.16-100.el9_4.1 |
aide-debugsource Red Hat:rhel_eus:9.4::appstream | All versions | 0:0.16-100.el9_4.1 |
aide Red Hat:rhel_eus_long_life:8.4::appstream | All versions | 0:0.16-14.el8_4.2 |
aide-debuginfo Red Hat:rhel_eus_long_life:8.4::appstream | All versions | 0:0.16-14.el8_4.2 |
Products include Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment.
How do I fix CVE-2025-54389?
Upgrade to a fixed version.
Is CVE-2025-54389 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54389 exists.
Other vulnerabilities in aide
Sources
Also known as ALSA-2025:14493, ALSA-2025:14573, ALSA-2025:14592, AZL-66297, AZL-66434, CLSA-2026-1768410745 and 20 more.