high8.4
CVE-2025-24337
Insecure default config access in WriteFreely
Impact
WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/writefreely/writefreely | <= 0.15.1 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| WriteFreely | through 0.15.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/writefreely/writefreely/releases/tag/v0.15.1
- https://raphus.social/@TV4Fun/113846757112643161
- https://www.openwall.com/lists/oss-security/2025/01/18/1
- https://github.com/advisories/GHSA-3qc3-mx6x-267h
- https://nvd.nist.gov/vuln/detail/CVE-2025-24337