CVE-2025-59349 Directories created via os.MkdirAll are not checked for permissions

What is CVE-2025-59349?

CVE-2025-59349 is a low-severity vulnerability in dragonflyoss dragonfly, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access permissions. This function does not perform any permission checks when a given directory path already exists. This allows a local attacker to create a directory to be used later by DragonFly2 with broad permissions before DragonFly2 does so, potentially allowing the attacker to tamper with the files. This vulnerability is fixed in 2.1.0.

Weakness: CWE-732

Which versions are affected by CVE-2025-59349?

6 open source packages ship an affected version, including github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2. It affects 1 product.

Products include Linuxfoundation Dragonfly.

How do I fix CVE-2025-59349?

Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.

Is CVE-2025-59349 being exploited?

There is no known exploitation of CVE-2025-59349 in the wild and no public exploit code.

Other vulnerabilities in dragonflyoss dragonfly

• CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key Critical 9.8
• CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access High 8.9
• CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints High 7.7
• CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses High 7.7
• CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8425-8r2f-mrv6, GO-2025-3964.