Critical USN-7632-1 1 CVE

libyaml-libyaml-perl vulnerability

Published Jul 9, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that YAML-LibYAML incorrectly handled certain file
names. An attacker could possibly use this issue to overwrite arbitrary
files.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	libyaml-libyaml-perl	0.83+ds-1ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS	libyaml-libyaml-perl	0.89+ds-1ubuntu0.24.04.1

Vulnerabilities 1

Critical 9.1

CVE-2025-40908

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

TINITA YAML::LibYAML libyaml-libyaml-perl libyaml-libyaml-perl Debian Ubuntu Azure Linux

Jun 1, 2025

References

report
https://ubuntu.com/security/CVE-2025-40908