CVE-2025-60020

Publication date 24 September 2025

Last updated 2 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nncp	26.04 LTS resolute	Not affected
	25.10 questing	Fixed 8.11.0-4+deb13u1build0.25.10.1
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Fixed 8.10.0-8ubuntu0.3+esm3
	22.04 LTS jammy	Fixed 8.5.0-1ubuntu0.1+esm3

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

Parameter	Value
Base score	6.4 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

USN-8359-1
NNCP vulnerability
1 June 2026