Symlink Vulnerability in OpenVPN 3 Client: Directory Ownership and Permission Manipulation
Summary
CVE-2025-3908: The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destina... Affects openvpn3-client versions < 24.1+dfsg-1. Fixed in 24.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenVPN 3 Client is a widely used open-source software that enables secure point-to-point or site-to-site connections in routed or bridged configurations. It is known for its flexibility, security features, and support for various platforms. However, versions 20 through 24 on Linux have a critical vulnerability that allows local attackers to exploit symlink behavior, potentially compromising directory ownership and permissions.
Vulnerability Detail
The vulnerability, identified as CVE-2025-3908, arises from the configuration initialization tool in OpenVPN 3 Linux. It allows a local attacker to create symlinks pointing to arbitrary directories. When the tool is executed, it can inadvertently change the ownership and permissions of the targeted directory, leading to unauthorized access or modification of sensitive files. This vulnerability is particularly concerning as it can be exploited without requiring elevated privileges, making it accessible to any local user.
How To Fix
Minimum fixed version
24.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvpn3-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict local user access to the OpenVPN configuration tool or implement strict file permissions to prevent unauthorized symlink creation. Additionally, monitoring symlink usage in critical directories can help mitigate the risk until a patch is applied.
Conclusion
The CVE-2025-3908 vulnerability in OpenVPN 3 Client poses a significant risk due to its potential for unauthorized access through symlink manipulation. Users are strongly advised to update to the latest version to mitigate this risk and consider implementing workarounds in the interim.
See every vulnerability recorded for openvpn3-client →
FAQ
CVE-2025-3908 is a vulnerability in OpenVPN 3 Client that allows local attackers to exploit symlinks, potentially altering directory ownership and permissions.
Versions 20 through 24 of OpenVPN 3 Client on Linux are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing strict file permissions and monitoring symlink usage as temporary workarounds.
For more information, you can visit the official OpenVPN website or check vulnerability databases such as the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for openvpn3-client.
