CVE-2025-12801Medium· 6.5▾ Sunlit

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 4, 2026

Updated

Jun 25, 2026

CVSS

6.5

Vendor

—

Product

—

CWE

CWE-279, CWE-732

Depth score

36 · Low

EPSS

0.46% · p39

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 122 days

Mar 4, 2026Published
Disclosed via NVD
Jun 25, 2026Record revised
Last analysed / modified upstream
Jul 4, 2026EPSS first tracked
0.5%

CWE-279 CWE-732 #nvd

Full technical detail▾

Overview

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed