CVE-2025-64184 Dosage vulnerable to Directory Traversal through crafted HTTP responses
A remote attacker can write arbitrary files outside the target directory by manipulating HTTP Content-Type headers during comic image downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64184?
CVE-2025-64184 is a high-severity path traversal vulnerability in webcomics dosage, published on 7 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). This issue is fixed in version 3.2.
Weakness: CWE-22
Which versions are affected by CVE-2025-64184?
3 open source packages ship an affected version, including dosage.
| Package | Affected | Fixed in |
|---|---|---|
dosage PyPI | All versions | 3.2 |
dosage PyPI | All versions | 3.2 |
dosage PyPI | All versions | 3.2 |
How do I fix CVE-2025-64184?
Upgrade dosage to 3.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-64184 being exploited?
There is no known exploitation of CVE-2025-64184 in the wild and no public exploit code.
Sources
Also known as GHSA-4vcx-3pj3-44m7, PYSEC-2026-1316, UBUNTU-CVE-2025-64184.