Vulnerability · Published Sep 16, 2025 · Assigned by GitHub_M

CVE-2025-59336Relative Path Traversal in Luanox

Medium 6.9

In plain English

A medium-severity path traversal in luanox from lumen-oss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 60.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This causes the uploaded file to be stored at the relative path location. If planned carefully, this could overwrite a runtime file and cause the website to crash. This vulnerability is fixed by 0.1.1.

Affected products (as reported)

Vendor	Product	Versions
lumen-oss	luanox	< 0.1.1

Weakness: CWE-22, CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/lumen-oss/luanox/security/advisories/GHSA-42c5-x4pj-4p3w x_refsource_CONFIRM
https://github.com/lumen-oss/luanox/commit/2b6237f3baaa1d905c491fca29f8301835721c46 x_refsource_MISC
https://github.com/lumen-oss/luanox/commit/5198640c9644e2fcef5809f83b9ab0a9b4d0eeb2 x_refsource_MISC