Description
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | e17 | 0.25.4-1 | — |
| Debian 13 | e17 | 0.25.4-1 | — |
| Debian 12 | e17 | 0.25.4-1 | — |
| Debian 11 | e17 | 0.24.2-8+deb11u1 | DSA-5233-1 |
| Debian 10 | e17 | 0.22.4-2+deb10u1 | DLA-3115-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | e17 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | e17 | 0.25.3-1ubuntu0.1~esm1 | USN-8981-1 |
| Ubuntu Pro 20.04 LTS | e17 | 0.23.1-4ubuntu0.1~esm1 | USN-8981-1 |
| Ubuntu Pro 18.04 LTS | e17 | 0.17.6-1.1ubuntu0.1~esm1 | USN-8981-1 |
| Ubuntu Pro 16.04 LTS | e17 | 0.17.6-1ubuntu0.1~esm1 | USN-8981-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | enlightenment | 0.25.4-bp154.4.3.1 | openSUSE-SU-2022:10153-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | enlightenment | 0.25.4-bp154.4.3.1 | openSUSE-SU-2022:10153-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Ubuntu Enlightenment Mount Priv Esc
exploit/linux/local/ubuntu_enlightenment_mount_priv_esc
Exploit-DB 1
- Enlightenment v0.25.3 - Privilege escalation EDB-51180 · local · Apr 1, 2023
GitHub 8 repositories
-
MaherAzzouzi/CVE-2022-37706-LPE-exploit ★ 322 · Sep 12, 2022
A reliable exploit + write-up to elevate privileges to root. (Tested on Ubuntu 22.04)
-
ECU-10525611-Xander/CVE-2022-37706 ★ 2 · Sep 18, 2022
All Credit to MaherAzzouzi (https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit). This is a copy of the exploit for CTFs
-
d3ndr1t30x/CVE-2022-37706 ★ 1 · Dec 10, 2024
Privilege escaltion exploit script for Boardlight machine on HackTheBox. I had access as the Larissa user and ran this script from the /tmp directory; script has been adjusted accordingly.
-
KaoXx/CVE-2022-37706 ★ 1 · Sep 10, 2024
-
Massive43/CVE-2022-37706 ★ 0 · Jun 24, 2026
ROOT TOOL
-
sanan2004/CVE-2022-37706 ★ 0 · Aug 18, 2024
PoC
-
TACTICAL-HACK/CVE-2022-37706-SUID ★ 0 · Jul 19, 2024
CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation
-
junnythemarksman/CVE-2022-37706 ★ 0 · Jun 3, 2024
Exploit created by nu11secur1ty (https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- USN-8981-1 e17 vulnerability Ubuntu Security Notices (USN) · Nov 4, 2026
- DSA-5233-1 e17 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3115-1 e17 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2022:10153-1 Security update for enlightenment SUSE / openSUSE Security Updates · Feb 4, 2026