# FreedomBox security issue - CVE-2025-68462
**URL:** https://discuss.freedombox.org/t/freedombox-security-issue-cve-2025-68462/4035
**Category:** Announcements
**Created:** [December 18, 2025, 5:47pm UTC](https://discuss.freedombox.org/t/freedombox-security-issue-cve-2025-68462/4035 "2025-12-18T17:47:34Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jvalleroy](https://discuss.freedombox.org/u/jvalleroy)
#### Post date: [December 18, 2025, 5:47pm UTC](https://discuss.freedombox.org/t/freedombox-security-issue-cve-2025-68462/4035/1 "2025-12-18T17:47:34Z")
A security issue has been found in FreedomBox, related to private data used for backups of several applications. If your FreedomBox has not already automatically updated to 25.17.1, please update it as soon as possible.
Versions affected by the issue:
- At least all versions between 21.3 and 25.17.
Versions that include a fix for the issue:
- 25.17.1 in trixie-backports, testing, and unstable
- 25.9.3+deb13u1, which should be included in the next stable point release.
Debian security tracker link:
> **[CVE-2025-68462](https://security-tracker.debian.org/tracker/CVE-2025-68462)**
Salsa issue:
> **[backups: Backup data on disk can be read by any user (#2554) · Issues ·...](https://salsa.debian.org/freedombox-team/freedombox/-/issues/2554)**
>
> root@freedombox:/var/lib/plinth/backups-data# ls -al total 40808 drwxr-xr-x 1 root root 134 Nov...
The issue is due to the permissions on the directory /var/lib/plinth/backups-data, which could allow any user or program on the FreedomBox to access data stored in this directory. This directory is used when creating a backup for the following apps:
- Dynamic DNS
- Miniflux
- Nextcloud
- WordPress
- Zoph
In the case of Dynamic DNS, the stored data includes the password for the configured DDNS service. In the case of the other apps, they are database dumps that include private data for the users of those apps.
Commit that fixes the issue:
> **[backups: Set proper permissions for backups-data directory (8ba44499) ·...](https://salsa.debian.org/freedombox-team/freedombox/-/commit/8ba444990b4af6eec4b6b2b26482b107d7ff1229)**
>
> Fixes: #2554 - Update permissions on the backups-data directory so that files are only accessible by root users. - Ensure that the directory is created by the 'backups' app and...
The issue is fixed with the following changes:
- Update permissions on the backups-data directory so that files are only accessible by root users.
- Ensure that the directory is created by the ‘backups’ app and not by each of the apps that take the backup.
---
### Author:  [@jvalleroy](https://discuss.freedombox.org/u/jvalleroy)
#### Post date: [December 18, 2025, 8:48pm UTC](https://discuss.freedombox.org/t/freedombox-security-issue-cve-2025-68462/4035/2 "2025-12-18T20:48:15Z")