CVE-2025-3155 | Yelp: arbitrary file read

Exp

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

Published: 2025-04-03 Last update: 2025-08-12 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-3155 is rated High Exploit Risk (82.9/100): CVSS High severity, with high exploitation likelihood (EPSS 10.26%, 95th percentile). 2 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +8.95% over the last day, indicating growing attacker interest. Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2025-3155

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2025-3155

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.31% 10.26% +8.95%
2 2026-06-02 1.01% 1.31% +0.30%
3 2026-05-12 — 1.01% —

Full EPSS history (9 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-3155

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.4 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 2.8 4.0 [email protected]

Weakness enumeration for CVE-2025-3155

OS Trackers for CVE-2025-3155

vendor priority summary link
alpine — CVE-2025-3155: 2 source package rows (yelp, yelp-xsl); 6 state rows across 3 repos (3.21-community, 3.22-community, edge-community); fixed 6, open 0. https://security.alpinelinux.org/vuln/CVE-2025-3155
debian not yet assigned CVE-2025-3155 not yet assigned priority: Debian including 2 source packages (yelp, yelp-xsl), 10 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10. https://security-tracker.debian.org/tracker/CVE-2025-3155
redhat high — https://access.redhat.com/security/cve/CVE-2025-3155
suse high CVE-2025-3155 severity important: SUSE including 30 source package names (libyelp0-3.20.1-7.3.1, libyelp0-41.2-150400.3.3.1, …), 49 product×package rows across 11 product lines (SUSE Liberty Linux 8, SUSE Liberty Linux 9, … (11 product lines)): Fixed 49. https://www.suse.com/security/cve/CVE-2025-3155/
ubuntu medium CVE-2025-3155 medium priority: Ubuntu including 1 source packages (yelp), 9 status rows across 9 suites (bionic, focal, jammy, noble, oracular, plucky, questing, upstream, xenial): released 5, needs-triage 3, not-affected 1. https://ubuntu.com/security/CVE-2025-3155

Affected software / configurations for CVE-2025-3155

Vendor Product Version Raw CPE
gnome yelp 42.2-8 cpe:2.3:a:gnome:yelp:42.2-8:*:*:*:*:*:*:*
debian debian_linux 11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
redhat codeready_linux_builder 8.0 cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
redhat codeready_linux_builder 9.0 cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64 8.0_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64 9.0_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64_eus 8.8_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.8_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64_eus 9.2_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64_eus 9.4_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_arm64_eus 9.6_aarch64 cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_eus 8.8 cpe:2.3:a:redhat:codeready_linux_builder_for_eus:8.8:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_eus 9.2 cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.2:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_eus 9.4 cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems 8.0_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems 9.0_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems_eus 8.8_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.2_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.4_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.6_s390x cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian 8.0_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian 9.0_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian_eus 8.8_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian_eus 9.2_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian_eus 9.4_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
redhat codeready_linux_builder_for_power_little_endian_eus 9.6_ppc64le cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhat enterprise_linux 9.0 cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 9.2 cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
redhat enterprise_linux_eus 9.4 cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
redhat enterprise_linux_eus 9.6 cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 8.0 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 8.8_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.8_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 9.0_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 9.2_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 9.4_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 9.6_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 8.0_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.8_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 9.2_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 9.4_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 9.6_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 8.0_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 9.0_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.8_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 9.2_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 9.4_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 9.6_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.2 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.6 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 9.2 cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 9.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 9.6 cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.4 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.6 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.8 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 8.4 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 8.6 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 8.8 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 9.0 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 9.2 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
redhat enterprise_linux_update_services_for_sap_solutions 9.4 cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*

References for CVE-2025-3155

URL Tags
https://access.redhat.com/errata/RHSA-2025:4450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4455 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4456 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4457 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4505 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:4532 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:7430 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:7569 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-3155 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2357091 Exploit Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/04/04/1 Mailing List
https://lists.debian.org/debian-lts-announce/2025/05/msg00036.html Mailing List
https://lists.debian.org/debian-lts-announce/2025/05/msg00037.html Mailing List
https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2 Exploit Third Party Advisory
cvelogic Threat Intelligence