CVE-2025-64184 Details
Description
Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). This issue is fixed in version 3.2.
A directory traversal vulnerability has been identified in Dosage, a comic strip downloader and archiver, in versions prior to 3.2. When downloading comic images, the application constructs file names based on various aspects of the remote comic. While the basename is correctly sanitized to remove directory-traversing characters, the file extension is derived from the HTTP Content-Type header. This behavior enables a remote attacker, or a Man-in-the-Middle if the comic is served over HTTP, to write arbitrary files outside the designated directory, provided certain conditions are met.
Users can upgrade to Dosage version 3.2, where this vulnerability has been fixed. Distributors may also backport the fix to older versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2025CISA-ADP
Assessed Nov 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e | [email protected] | Source CodeVendor |
| https://github.com/webcomics/dosage/security/advisories/GHSA-4vcx-3pj3-44m7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webcomics dosage | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2025 | New CVE Received | [email protected] |