EpicVon2468 fixurjavainstall directory deletion in manual page generation

Executive brief

fixurjavainstall is a utility used to manage Java Virtual Machine installations. In affected versions, running the command to generate manual pages can accidentally delete all existing system administration manuals (man8) on the user's computer. This results in a loss of local documentation but does not expose sensitive data.

Technical details

A vulnerability exists in fixurjavainstall versions 0.8.0 and earlier when built with the 'dev' crate feature. The root cause is development-only code (CWE-489) that was accidentally left in the release, which performs a destructive file system operation on '/usr/share/man/man8'. When a user executes the 'fuji manual' command, the application may entirely remove and re-create this directory, wiping all existing system manual entries. This is a local availability issue with no confidentiality or integrity impact to other system data. A fix is available in version 0.8.1.

Affected products

• EpicVon2468 fixurjavainstall <= 0.8.0

Timeline

• 2026-05-22: disclosed
• 2026-06-25: advisory: GitHub Advisory published

References

• https://api.github.com/users/EpicVon2468
• https://github.com/EpicVon2468
• https://api.github.com/users/EpicVon2468/gists%7B/gist_id%7D
• https://api.github.com/users/EpicVon2468/repos
• https://avatars.githubusercontent.com/u/136974526?v=4
• https://api.github.com/users/EpicVon2468/events%7B/privacy%7D