CVE-2025-56499

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-56499
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Cherrling/CVE-2025-56499 Exploit Third Party Advisory
https://github.com/MetaCubeX/mihomo/tree/v1.19.11 Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:metacubex:mihomo:1.9.11:*:*:*:*:*:*:*
History

31 Dec 2025, 14:01

Type Values Removed Values Added
References () https://github.com/Cherrling/CVE-2025-56499 - () https://github.com/Cherrling/CVE-2025-56499 - Exploit, Third Party Advisory
References () https://github.com/MetaCubeX/mihomo/tree/v1.19.11 - () https://github.com/MetaCubeX/mihomo/tree/v1.19.11 - Product
CPE cpe:2.3:a:metacubex:mihomo:1.9.11:*:*:*:*:*:*:*
First Time Metacubex
Metacubex mihomo

19 Nov 2025, 14:15

Type Values Removed Values Added
CWE CWE-284
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

18 Nov 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-18 19:15

Updated : 2025-12-31 14:01

NVD link : CVE-2025-56499

Mitre link : CVE-2025-56499

CVE.ORG link : CVE-2025-56499

JSON object : View

Products Affected

metacubex

  • mihomo
CWE
CWE-284

Improper Access Control