CVE-2025-49842— conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
Quick assessment
Affected
conda-forge conda-forge-webservices
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
conda-forge-webservices是conda-forge开源的一个部署用于运行condaforge管理命令和linting的web应用程序。 conda-forge-webservices 2025.3.24之前版本存在安全漏洞，该漏洞源于Docker容器以root用户执行命令，可能导致权限提升。
Possible ATT&CK Techniques 1 AI
T1505 · Server Software Component
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-49842
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
Source: CVE Program / CVE List V5
Vulnerability Description
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5
Vulnerability Title
conda-forge-webservices 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
conda-forge-webservices是conda-forge开源的一个部署用于运行condaforge管理命令和linting的web应用程序。 conda-forge-webservices 2025.3.24之前版本存在安全漏洞，该漏洞源于Docker容器以root用户执行命令，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| conda-forge | conda-forge-webservices | < 2025.3.24 | - |
|
II. Public POCs for CVE-2025-49842
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-49842
请登录查看更多情报信息。
Same Patch Batch · conda-forge · 2025-06-17 · 3 CVEs total
| CVE-2025-49843 | conda-smithy Has Incorrect Default File Permissions | |
| CVE-2025-49824 | conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack |
IV. Related Vulnerabilities
Same vendor: conda-forge
-
CVE-2026-46699
conda-smithy vulnerable to misrouted repository invitation b -
CVE-2025-49824
conda-smithy Insecure Encryption Vulnerable to Oracle Paddin -
CVE-2025-49843
conda-smithy Has Incorrect Default File Permissions -
CVE-2025-49598
conda-forge-ci-setup Allows Arbitrary Code Execution via Ins -
CVE-2025-35471
conda-forge openssl-feedstock writable OPENSSLDIR
Same weakness: CWE-276
-
CVE-2026-81682
openssl_encrypt before 1.4.9 Insecure File Permissions -
CVE-2026-69665
SKYSEA Client View和SKYMEC IT Manager权限错误漏洞 -
CVE-2026-78553
Insecure Flask Secret-Key File Permissions Allow Local Admin -
CVE-2025-68825
HCL Hive is affected by incorrect default permissions -
CVE-2026-18273
Kenwood DNR1007XR USB Incorrect Default Permissions Local Pr
V. Comments for CVE-2025-49842
No comments yet