Vulnerability · Published Apr 3, 2025 · Assigned by redhat
CVE-2025-3155Yelp: arbitrary file read
High 7.4
In plain English
A high-severity open redirect in yelp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 13.1% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)13.1%top 3.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | yelp | 2:3.28.1-3.el8_10.1 | ALSA-2025:7569 |
| AlmaLinux:9 | yelp | 2:40.3-2.el9_6.1 | ALSA-2025:7430 |
| AlmaLinux:8 | yelp-devel | 2:3.28.1-3.el8_10.1 | ALSA-2025:7569 |
| AlmaLinux:9 | yelp-devel | 2:40.3-2.el9_6.1 | ALSA-2025:7430 |
| AlmaLinux:8 | yelp-libs | 2:3.28.1-3.el8_10.1 | ALSA-2025:7569 |
| AlmaLinux:9 | yelp-libs | 2:40.3-2.el9_6.1 | ALSA-2025:7430 |
| AlmaLinux:8 | yelp-xsl | 3.28.0-2.el8_10.1 | ALSA-2025:7569 |
| Alpine:v3.21 | yelp | 42.2-r4 | ALPINE-CVE-2025-3155 |
| Alpine:v3.22 | yelp | 42.2-r5 | ALPINE-CVE-2025-3155 |
| Alpine:v3.23 | yelp | 42.2-r5 | ALPINE-CVE-2025-3155 |
| Alpine:v3.24 | yelp | 42.2-r5 | ALPINE-CVE-2025-3155 |
| Alpine:v3.21 | yelp-xsl | 42.1-r2 | ALPINE-CVE-2025-3155 |
| Alpine:v3.22 | yelp-xsl | 42.1-r3 | ALPINE-CVE-2025-3155 |
| Alpine:v3.23 | yelp-xsl | 42.1-r3 | ALPINE-CVE-2025-3155 |
| Alpine:v3.24 | yelp-xsl | 42.1-r3 | ALPINE-CVE-2025-3155 |
| Debian:12 | yelp | 42.2-1+deb12u1 | DEBIAN-CVE-2025-3155 |
| Debian:12 | yelp | 42.2-1+deb12u1 | DSA-5927-1 |
| Debian:13 | yelp | 42.2-3 | DEBIAN-CVE-2025-3155 |
| Debian:14 | yelp | 42.2-3 | DEBIAN-CVE-2025-3155 |
| Debian:12 | yelp-xsl | 42.1-2+deb12u1 | DEBIAN-CVE-2025-3155 |
| Debian:12 | yelp-xsl | 42.1-2+deb12u1 | DSA-5927-1 |
| Debian:13 | yelp-xsl | 42.1-4 | DEBIAN-CVE-2025-3155 |
| Debian:14 | yelp-xsl | 42.1-4 | DEBIAN-CVE-2025-3155 |
| Rocky Linux:8 | yelp | 2:3.28.1-3.el8_10.1 | RLSA-2025:7569 |
| Rocky Linux:9 | yelp | 2:40.3-2.el9_6.1 | RLSA-2025:7430 |
| Rocky Linux:8 | yelp-xsl | 0:3.28.0-2.el8_10.1 | RLSA-2025:7569 |
| Ubuntu:22.04:LTS | yelp | 42.1-1ubuntu0.1 | USN-7447-1 |
| Ubuntu:22.04:LTS | yelp | 42.1-1ubuntu0.1 | UBUNTU-CVE-2025-3155 |
| Ubuntu:24.04:LTS | yelp | 42.2-1ubuntu0.24.04.1 | USN-7447-1 |
| Ubuntu:24.04:LTS | yelp | 42.2-1ubuntu0.24.04.1 | UBUNTU-CVE-2025-3155 |
| Ubuntu:22.04:LTS | yelp-xsl | 42.0-1ubuntu0.1 | USN-7447-1 |
| Ubuntu:24.04:LTS | yelp-xsl | 42.1-2ubuntu0.24.04.1 | USN-7447-1 |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
References
- RHSA-2025:4450 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4451 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4455 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4456 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4457 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4505 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4532 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7430 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7569 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-3155 vdb-entry, x_refsource_REDHAT
- RHBZ#2357091 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/yelp/-/issues/221
- https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2 exploit
- http://www.openwall.com/lists/oss-security/2025/04/04/1
- https://lists.debian.org/debian-lts-announce/2025/05/msg00036.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00037.html