Executive brief
Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
Affected products
- Go github.com/dragonflyoss/dragonfly
- Go d7y.io/dragonfly/v2
Junglewise Threat Intelligence
CVE-2025-59349: GO-2025-3964 - Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
CVE-2025-59349 · Severity: medium · CVSS 4 · Published 2025-09-24
Technologies: github.com/dragonflyoss/dragonfly (Go), d7y.io/dragonfly/v2 (Go). Vendors: Go.
Related threats
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE
- GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
- GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
- GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly