Skip to content
Fencer Vulns
medium 6.2

CVE-2025-54389 json

AIDE improper output neutralization vulnerability

published 2025-08-14 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-24862

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.

Patch / fix

  • advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment 0.19.2
  • aide Debian 12 0.18.3-1+deb12u4
  • aide Debian 13 0.19.1-2+deb13u1
  • aide Debian 14 0.19.2-1

debian advisories DEBIAN-CVE-2025-54389

  • aide Ubuntu 22.04 LTS 0.17.4-1ubuntu0.2
  • aide Ubuntu 24.04 LTS 0.18.6-2ubuntu0.1
  • aide Ubuntu Pro 14.04 LTS 0.16~a2.git20130520-2ubuntu0.1+esm2
  • aide Ubuntu Pro 16.04 LTS 0.16~a2.git20130520-3ubuntu0.1~esm2
  • aide Ubuntu Pro 18.04 LTS 0.16-3ubuntu0.1+esm1
  • aide Ubuntu Pro 20.04 LTS 0.16.1-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2025-54389

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • aide RHEL 10.0 0.18.6-8.el10_0.2
  • aide RHEL 8 0.16-15.el8_10.2
  • aide RHEL 9 0.16-103.el9_6.2
  • aide RHEL 7 ELS 0.15.1-13.el7_9.5
  • aide RHEL 9.0 E4S 0.16-100.el9_0.1
  • aide RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 0.16-15.el8_6.1
  • aide RHEL 9.4 EUS 0.16-100.el9_4.1
  • aide RHEL 9.2 E4S 0.16-100.el9_2.1

red hat advisories RHSA-2025:15728RHSA-2025:15409RHSA-2025:15058RHSA-2025:15039RHSA-2025:15038RHSA-2025:14981

  • aide Linux Micro 6.1 0.18.6-slfo.1.1_2.1
  • aide Linux Micro 6.0 0.18.6-2.1

suse advisories SUSE-SU-2025:20754-1SUSE-SU-2025:20657-1

  • aide openSUSE Tumbleweed 0.19.2-1.1

opensuse advisories openSUSE-SU-2025:15474-1

  • aide AlmaLinux 8 0.16-15.el8_10.2
  • aide AlmaLinux 10 0.18.6-8.el10_0.2
  • aide AlmaLinux 9 0.16-103.el9_6.2

almalinux advisories ALSA-2025:14573ALSA-2025:14592ALSA-2025:14493

  • aide Rocky Linux 9 0.16-103.el9_6.2
  • aide Rocky Linux 10 0.18.6-8.el10_0.2
  • aide Rocky Linux 8 0.16-15.el8_10.2

rocky linux advisories RLSA-2025:14493RLSA-2025:14592RLSA-2025:14573

  • aide Azure Linux 3.0 0.18.6-2
  • aide CBL-Mariner 2.0 0.16-17

azure linux advisories AZL-66297AZL-66434

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-54389 updated cvss 7.1

aide: improper output neutralization enables bypassing

  • Red Hat Enterprise Linux 6 aide
    affected: workaround, no fix planned “Currently, no mitigation is available for this vulnerability.”
  • Red Hat OpenShift File Integrity Operator - FIO 1 compliance
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:21913
  • Red Hat Enterprise Linux AppStream (v. 8) aide 0.16-15.el8_10.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14573
  • Red Hat Enterprise Linux AppStream (v. 9) aide 0.16-103.el9_6.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14493
  • Red Hat Enterprise Linux AppStream (v. 10) aide 0.18.6-8.el10_0.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14592
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) aide 0.16-11.el8_2.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14980
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) aide 0.16-14.el8_4.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14981
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) aide 0.16-15.el8_6.1 Red Hat Enterprise Linux AppStream E4S (v.8.6) aide 0.16-15.el8_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15058
show 9 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) aide 0.16-15.el8_8.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14982
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) aide 0.16-100.el9_0.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15409
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) aide 0.16-100.el9_2.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15038
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) aide 0.16-100.el9_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15039
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) aide 0.16-14.el8_4.2
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14981
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) aide 0.16-15.el8_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15058
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) aide 0.16-15.el8_8.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:14982
  • Red Hat Enterprise Linux Server (v. 7 ELS) aide 0.15.1-13.el7_9.5
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:15728
  • Red Hat OpenShift File Integrity Operator - FIO 1 compliance
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

  • aide aide

Classification

Weakness
  • CWE-117 Improper Output Neutralization for Logs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.