CVE-2025-61557 Details

A directory traversal vulnerability has been identified in nixseparatedebuginfod versions prior to 0.4.1. This vulnerability allows a client to request source files from paths outside the Nix store, potentially disclosing the contents of any readable file on the system. The issue arises because nixseparatedebuginfod does not properly validate file paths before serving them. While the impact is generally limited to world-readable files when using the NixOS module, more severe consequences can occur if nixseparatedebuginfod is run manually or exposed to the internet.

Users can update to nixseparatedebuginfod version 0.4.1 or later, where this vulnerability has been fixed.