Path traversal in nix - CVE-2024-45593
Published: September 10, 2024 / Updated: April 8, 2026
Vulnerability identifier: #VU125376
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45593
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write to arbitrary file system locations accessible to the Nix process.
The vulnerability exists due to improper path restriction in NAR unpacking when processing a crafted NAR. A remote user can supply a specially crafted NAR to write to arbitrary file system locations accessible to the Nix process.
When the Nix daemon is used, the file writes occur with root permissions. User interaction is required to unpack the crafted NAR.
Affected software
nix
Ubuntu
nix (Ubuntu package)
Ubuntu
nix (Ubuntu package)
How to mitigate CVE-2024-45593
Install security update from vendor's website.
nix - update to 2.24.6
nix (Ubuntu package) - addressed in versions 2.6.0+dfsg-3ubuntu0.1~esm1, 2.18.1+dfsg-1ubuntu5+esm2
nix (Ubuntu package) - addressed in versions 2.6.0+dfsg-3ubuntu0.1~esm1, 2.18.1+dfsg-1ubuntu5+esm2