aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path
    concatenation of the name of an attachment part, (CVE-2025-49466)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path     concatenation of the name of an attachment part, (CVE-2025-49466)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-edd8754757 advisory.

    Automatic update for aerc-0.20.1-3.fc43.

    ##### **Changelog**

    ```
    * Thu Jun  5 2025 Robin Jarry <robin@jarry.cc> - 0.20.1-3
    - Fix CVE-2025-49466 (fedora#2370376)
    * Wed Apr 16 2025 Michael J Gruber <mjg@fedoraproject.org> - 0.20.1-2
    - exclude i686 arch for i686 leaf package

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5566a46596 advisory.

    Fix CVE-2025-49466 (fedora#2370375)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-8efa183a30 advisory.

    Fix CVE-2025-49466 (fedora#2370376)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
436210	Alpine: multiple aerc packages: security update to 1.21.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
436210	Alpine: multiple aerc packages: security update to 1.21.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
250445	Linux Distros Unpatched Vulnerability : CVE-2025-49466	Nessus	Misc.	medium
249153	Fedora 43 : aerc (2025-edd8754757)	Nessus	Fedora Local Security Checks	medium
238452	Fedora 41 : aerc (2025-5566a46596)	Nessus	Fedora Local Security Checks	medium
238449	Fedora 42 : aerc (2025-8efa183a30)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-49466

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium