Homepage

Incorrect Permission Assignment for Critical Resource The advisory has been revoked - it doesn't affect any version of package nfsv4-client-utils  (opens in a new tab)

Threat Intelligence

EPSS
0.47% (39th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-NFSV4CLIENTUTILS-15467729
  • published12 Mar 2026
  • disclosed5 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 5 Mar 2026

CVE-2025-12801  (opens in a new tab)
CWE-732  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nfsv4-client-utils package and not the nfsv4-client-utils package as distributed by AlmaLinux.

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.