Log in Start free

Vulnerability · Published May 16, 2025 · Assigned by TQtC

CVE-2025-4211Improper Link Resolution Before File Access in QFileSystemEngine on Windows

High 7.3

In plain English

A high-severity security flaw in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.2%top 88.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile. This issue affects all version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1. It is fixed in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, 6.9.0

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-4211
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-4211
Ubuntu:25.10qt6-baseno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.10qt6-baseno fix listedUBUNTU-CVE-2025-4211
Ubuntu:22.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-4211
Ubuntu:24.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-4211
Ubuntu:25.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2025-4211
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-4211
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-4211
Ubuntu:25.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-4211
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-4211

Affected products (as reported)

VendorProductVersions
Qt Qt 0 – through 5.15.186.0.0 – through 6.5.86.6.0 – through 6.8.1

Weakness: CWE-59 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P

References