CVE-2024-25711: Directory Traversal Vulnerability in diffoscope
Summary
CVE-2024-25711: diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Affects diffoscope versions < 256. Fixed in 256. How to fix ↓
Also tracked for
- diffoscope · Debian:11
The same CVE-2024-25711 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
diffoscope is a tool for in-depth comparison of files, archives, and directories. It is commonly used to analyze differences between two binary files or directories. This vulnerability affects versions prior to 256. The tool allows users to compare GPG files, and it supports an option called --use-embedded-filenames, which enables the extraction of embedded filenames from GPG files. However, a flaw in the implementation of this option allows an attacker to perform directory traversal attacks by embedding a malicious filename. This can lead to the disclosure of sensitive files, such as the user's SSH private key.
Vulnerability Detail
The vulnerability in diffoscope arises from the lack of proper validation of embedded filenames in GPG files. By crafting a GPG file with a specially crafted embedded filename, an attacker can traverse directories and access files outside the intended scope. This can result in the unauthorized disclosure of sensitive information, including private keys or other confidential data. The issue exists in versions prior to 256, where the value of the --use-embedded-filenames option is trusted without proper sanitization.
How To Fix
Latest published version: 332.0.0 as of 22 Oct 2026
pip install --upgrade "diffoscope==332.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
256
This is the first release that contains the fix.
pip install --upgrade "diffoscope==256"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the --use-embedded-filenames option when comparing GPG files with diffoscope. By not enabling this option, the vulnerability can be mitigated. However, this workaround may limit the functionality of the tool in certain scenarios.
Conclusion
The directory traversal vulnerability in diffoscope versions prior to 256 can be exploited by an attacker to access sensitive files outside the intended scope. To mitigate this issue, users should update to version 256 or later. Alternatively, they can avoid using the --use-embedded-filenames option as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for diffoscope →
FAQ
diffoscope is a tool used for in-depth comparison of files, archives, and directories. It helps identify differences between binary files or directories.
This vulnerability allows an attacker to perform directory traversal attacks and access sensitive files, potentially leading to unauthorized disclosure of confidential information.
Versions prior to 256 of diffoscope are affected by this vulnerability.
Yes, users should update to version 256 or later of diffoscope to fix this vulnerability.
As a temporary workaround, users can avoid using the --use-embedded-filenames option when comparing GPG files with diffoscope.
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
