Vulnerability · Published Nov 7, 2025 · Assigned by GitHub_M
CVE-2025-64184Dosage vulnerable to Directory Traversal through crafted HTTP responses
High 8.8
In plain English
A high-severity path traversal in dosage from webcomics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). This issue is fixed in version 3.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | dosage | 3.2 | PYSEC-2026-1316 |
| PyPI | dosage | 3.2 | GHSA-4vcx-3pj3-44m7 |
| Ubuntu:22.04:LTS | dosage | no fix listed | UBUNTU-CVE-2025-64184 |
| Ubuntu:24.04:LTS | dosage | no fix listed | UBUNTU-CVE-2025-64184 |
| Ubuntu:25.10 | dosage | no fix listed | UBUNTU-CVE-2025-64184 |
| Ubuntu:26.04:LTS | dosage | no fix listed | UBUNTU-CVE-2025-64184 |
| Ubuntu:26.10 | dosage | no fix listed | UBUNTU-CVE-2025-64184 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H