CVE-2025-3908 — OpenVPN / OpenVPN 3 Linux

CVE-2025-3908

OpenVPN / OpenVPN 3 Linux PUBLISHED

Description (CNA)

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Affected (CNA)

Vendor / product	Versions
OpenVPN / OpenVPN 3 Linux	affected v20 through v24

CWE

CWE-59

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-3908

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/05/20/2