CVE-2026-25850
in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.12%
- CWE
- CWE-281
- Published
- 2026-05-19
- Last modified
- 2026-05-19
Affected products
- OpenHarmony OpenHarmony
Weakness type
Related vulnerabilities
- CVE-2026-88016 — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- CVE-2026-58510 — GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2025-14779 — Improper Access Control via Secret Type Management API in WSO2 Identity Server
- CVE-2026-23556 — oxenstored keeps quota related use counts across domain destruction
- CVE-2026-58494 — Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- CVE-2026-4360 — Tarfile.extract() doesn't fully respect filter parameter
- CVE-2026-44947 — Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
- CVE-2026-40767 — WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability