CVE-2025-40908CRITICAL 9.1EPSS p32.8%

CVE-2025-40908CVE-2025-40908

Description

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.40% probability of exploitation · percentile 32.8% · 2026-08-03T12:00:16Z
Published2025-06-01
Last modified2025-07-02

Underlying weaknesses· 1

CWE-552

References

  1. https://github.com/ingydotnet/yaml-libyaml-pm/issues/120
  2. https://github.com/ingydotnet/yaml-libyaml-pm/pull/121
  3. https://github.com/ingydotnet/yaml-libyaml-pm/pull/122

1

TypeTargetConfidenceTier
WeaknessFiles or Directories Accessible to External Partiescwe-5520%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-4177
CVE
CVE-2026-29202
CVE
CVE-2025-1127
CVE
CVE-2025-55048
CVE
CVE-2025-27060
CVE
CVE-2025-1712
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.