Vulnerability Description
Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This causes the uploaded file to be stored at the relative path location. If planned carefully, this could overwrite a runtime file and cause the website to crash. This vulnerability is fixed by 0.1.1.
Related Weaknesses (CWE)
References
- https://github.com/lumen-oss/luanox/commit/2b6237f3baaa1d905c491fca29f8301835721
- https://github.com/lumen-oss/luanox/commit/5198640c9644e2fcef5809f83b9ab0a9b4d0e
- https://github.com/lumen-oss/luanox/security/advisories/GHSA-42c5-x4pj-4p3w
FAQ
What is CVE-2025-59336?
CVE-2025-59336 is a documented vulnerability. Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package ar...
How severe is CVE-2025-59336?
CVSS scoring is not yet available for CVE-2025-59336. Check NVD for updates.
Is there a patch for CVE-2025-59336?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.