CVE-2025-68462: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68462 is an incorrect permission assignment vulnerability in FreedomBox that allows local attackers to read database dump files from the backups-data directory. FreedomBox versions before 25.17.1 are affected. The vulnerability was published on December 18, 2025, and is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). It carries a CVSS v3.1 base score of 3.2 (Low), assigned by MITRE (Red Hat Advisory, ENISA EUVD).

The root cause is CWE-732 — FreedomBox fails to set restrictive filesystem permissions on the backups-data directory, which stores database dump files generated during backup operations. Because the directory is world-readable or accessible to unprivileged local users, any local user on the system can read these dump files without requiring elevated privileges. The fix was committed to the FreedomBox Salsa repository and tightens the directory permissions to prevent unauthorized access (Debian Salsa Commit). The attack vector is local, with high attack complexity and no privileges required, but exploitation is constrained to users with local filesystem access.

Successful exploitation allows a local attacker to read database dump files stored in the backups-data directory, potentially exposing sensitive application data, credentials, or personal information contained within those database backups. The confidentiality impact is rated Low with a changed scope, meaning the exposure crosses security boundaries beyond the attacker's own context. There is no integrity or availability impact. The risk is primarily data disclosure from FreedomBox-hosted applications whose databases are backed up (Red Hat Advisory, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-68462. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the FreedomBox system, significantly limiting the attacker pool (Red Hat Advisory).

1. Gain local access: Obtain a local shell on the FreedomBox system — this could be via an existing low-privileged user account, SSH access, or another vulnerability that provides local code execution.
2. Locate the backups-data directory: Navigate to the FreedomBox backups-data directory (typically under the FreedomBox data path, e.g., /var/lib/freedombox/backups-data/ or similar) using standard file and directory discovery commands (ls, find).
3. Read database dump files: Access and read the database dump files (e.g., .sql or compressed archive files) directly from the improperly permissioned directory without requiring elevated privileges.
4. Extract sensitive data: Parse the dump files offline to extract credentials, application data, or other sensitive information stored in the backed-up databases (Debian Salsa Commit).

• File System: Unexpected access timestamps on files within the backups-data directory by non-root or non-backup users; presence of copied database dump files in user home directories or /tmp.
• Logs: System audit logs (auditd) showing read access to the backups-data directory by unprivileged user accounts; shell history entries referencing the backups-data path.
• Process: Unusual processes (e.g., cat, cp, strings, grep) accessing database dump files under the FreedomBox backup directory from non-administrative user sessions.

Upgrade FreedomBox to version 25.17.1 or later, which sets correct restrictive permissions on the backups-data directory. As an interim workaround, administrators can manually restrict permissions on the backups-data directory using chmod and chown to limit access to only the root or backup service account. The official fix is available in the Debian Salsa repository (Debian Salsa Commit, Debian News).

Coverage of CVE-2025-68462 has been limited to automated vulnerability tracking platforms and aggregators. A brief technical write-up was published by Infinitsec describing the issue as an unauthenticated database backup file disclosure, though the local-only attack vector limits broader community concern. No significant vendor statements beyond the patch commit or notable researcher commentary have been identified (Infinitsec).