https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:06:59.849683+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-239006 EUVD-2026-239006 2026-10-04T00:06:59.928179+00:00 EUVD-2026-239006 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46717 fkie_cve-2025-46717 2026-10-04T00:06:59.928215+00:00

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-98cv-wqjx-wx8f GHSA-98cv-wqjx-wx8f — sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders 2026-10-04T00:06:59.928252+00:00

Affected: crates.io: sudo-rs

### Summary

Users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`.

### PoC

As root: ``` # mkdir /tmp/foo # chmod a-rwx /tmp/foo # touch /tmp/foo/secret_file ``` As a user without any (or limited) sudo rights: ``` $ sudo --list /tmp/foo/nonexistent_file sudo-rs: '/tmp/foo/nonexistent_file': command not found $ $ sudo --list /tmp/foo/secret_file sudo-rs: Sorry, user eve may not run sudo on host. ``` I.e. the user can distinguish whether files exist.

### Related Original sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.

### Impact Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.

### Credits This issue was identified by sudo-rs developer Marc Schoolderman

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-46717 UBUNTU-CVE-2025-46717 2026-10-04T00:06:59.928288+00:00

Affected: Ubuntu:24.04:LTS: rust-sudo-rs, Ubuntu:25.10: rust-sudo-rs

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks. Version 0.2.6 fixes the vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1043 WID-SEC-W-2025-1043 — sudo-rs: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen 2026-10-04T00:06:59.928313+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in sudo-rs ausnutzen, um Informationen offenzulegen.