CVE-2025-64343 Details
Description
(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.
A vulnerability in Conda Constructor versions prior to 3.13.0 allows excessive permissions to be granted during the installation process. The installation directory inherits permissions from its parent, which can be very permissive and allow write access to authenticated users. This issue creates a local attack vector if the installation occurs in a directory accessible to local users. For single-user installations in shared directories, these permissions persist after installation.
The vulnerability has been patched in Conda Constructor version 3.13.0. In this version, the installation process has been updated to remove write access for users, except for the installing user in single-user installations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2025CISA-ADP
Assessed Nov 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/conda/constructor/commit/c368383710a7c2b81ad1b0ecb9724b38d3577447 | [email protected] | Source CodeVendor |
| https://github.com/conda/constructor/releases/tag/3.13.0 | [email protected] | Release NotesVendor |
| https://github.com/conda/constructor/security/advisories/GHSA-vvpr-2qg4-2mrq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| conda constructor | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2025 | New CVE Received | [email protected] |