Skip to content
Fencer Intel
high 7.4

CVE-2025-3155 in the critical feed json

Yelp: arbitrary file read

published last yr. modified 5d ago also EUVD-2025-9635

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
13.1%
EPSS 13.1% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

Patch / fix

  • gitlab.gnome.org yelp 42.2-8
  • Red Hat Red Hat Enterprise Linux 8 0:3.28.0-2.el8_10.1, 2:3.28.1-3.el8_10.1
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 2:3.28.1-3.el8_2.1
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2:3.28.1-3.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 2:3.28.1-3.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 2:3.28.1-3.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2:3.28.1-3.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 2:3.28.1-3.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 2:3.28.1-3.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 2:3.28.1-3.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 2:40.3-2.el9_6.1
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:40.3-2.el9_0.1
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 2:40.3-2.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 2:40.3-2.el9_4.1
  • yelp Debian 12 42.2-1+deb12u1
  • yelp Debian 14, Debian 13 42.2-3
  • yelp-xsl Debian 12 42.1-2+deb12u1
  • yelp-xsl Debian 14, Debian 13 42.1-4

debian advisories DEBIAN-CVE-2025-3155

  • yelp Ubuntu 20.04 LTS 3.36.2-0ubuntu1.1
  • yelp Ubuntu 22.04 LTS 42.1-1ubuntu0.1
  • yelp Ubuntu 24.04 LTS 42.2-1ubuntu0.24.04.1
  • yelp Ubuntu Pro 16.04 LTS 3.18.1-1ubuntu4+esm2
  • yelp Ubuntu Pro 18.04 LTS 3.26.0-1ubuntu2+esm2

ubuntu advisories UBUNTU-CVE-2025-3155

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • yelp RHEL 8 2:3.28.1-3.el8_10.1
  • yelp-xsl RHEL 8 3.28.0-2.el8_10.1
  • yelp-libs RHEL 8 2:3.28.1-3.el8_10.1
  • yelp RHEL 9 2:40.3-2.el9_6.1
  • yelp-libs RHEL 9 2:40.3-2.el9_6.1
  • yelp RHEL 8.8 EUS 2:3.28.1-3.el8_8.1
  • yelp-libs RHEL 8.8 EUS 2:3.28.1-3.el8_8.1
  • yelp RHEL 9.2 EUS 2:40.3-2.el9_2.1

red hat advisories RHSA-2025:7569RHSA-2025:7430RHSA-2025:4532RHSA-2025:4505RHSA-2025:4456RHSA-2025:4457

  • yelp SLE Module for Desktop Applications 15 SP7, SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 42.2-150600.3.3.1
  • yelp-xsl SLE Module for Desktop Applications 15 SP7, SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 41.1-150400.3.3.1
  • yelp SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.20.1-7.3.1
  • yelp-xsl SLES LTSS Extended Security 12 SP5 3.20.1-6.3.1

suse advisories SUSE-SU-2025:2169-1SUSE-SU-2025:02170-1SUSE-SU-2025:02169-1SUSE-SU-2025:02168-1SUSE-SU-2025:02153-1

  • yelp openSUSE Tumbleweed 42.2-4.1
  • yelp-xsl openSUSE Tumbleweed 42.1-2.1

opensuse advisories openSUSE-SU-2025:15167-1openSUSE-SU-2025:15168-1

  • yelp AlmaLinux 8 2:3.28.1-3.el8_10.1
  • yelp-xsl AlmaLinux 8 3.28.0-2.el8_10.1
  • yelp-libs AlmaLinux 8 2:3.28.1-3.el8_10.1
  • yelp AlmaLinux 9 2:40.3-2.el9_6.1
  • yelp-libs AlmaLinux 9 2:40.3-2.el9_6.1

almalinux advisories ALSA-2025:7569ALSA-2025:7430

  • yelp Rocky Linux 9 2:40.3-2.el9_6.1
  • yelp Rocky Linux 8 2:3.28.1-3.el8_10.1
  • yelp-xsl Rocky Linux 8 3.28.0-2.el8_10.1

rocky linux advisories RLSA-2025:7430RLSA-2025:7569

  • yelp Alpine 3.21 42.2-r4
  • yelp Alpine 3.24, Alpine 3.23, Alpine 3.22 42.2-r5
  • yelp-xsl Alpine 3.21 42.1-r2
  • yelp-xsl Alpine 3.24, Alpine 3.23, Alpine 3.22 42.1-r3

alpine advisories ALPINE-CVE-2025-3155

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-3155 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-3155 updated cvss 7.4

yelp: Arbitrary file read

  • Red Hat Enterprise Linux 6 yelp
    affected: workaround, no fix planned “Currently, no mitigation is available for this vulnerability.”
  • Red Hat Enterprise Linux 7 yelp, yelp-xsl, yelp-libs Red Hat Enterprise Linux 9 yelp-xsl
    affected: workaround, no fix available “Currently, no mitigation is available for this vulnerability.”
  • Red Hat CodeReady Linux Builder EUS (v.8.8) yelp-devel 3.28.1-3.el8_8.1, yelp-debuginfo 3.28.1-3.el8_8.1, yelp-debugsource 3.28.1-3.el8_8.1, yelp-libs-debuginfo 3.28.1-3.el8_8.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4532
  • Red Hat CodeReady Linux Builder EUS (v.9.2) yelp-devel 40.3-2.el9_2.1, yelp-debuginfo 40.3-2.el9_2.1, yelp-debugsource 40.3-2.el9_2.1, yelp-libs-debuginfo 40.3-2.el9_2.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4505
  • Red Hat CodeReady Linux Builder EUS (v.9.4) yelp-devel 40.3-2.el9_4.1, yelp-debuginfo 40.3-2.el9_4.1, yelp-debugsource 40.3-2.el9_4.1, yelp-libs-debuginfo 40.3-2.el9_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4456
  • Red Hat Enterprise Linux AppStream (v. 8) yelp 3.28.1-3.el8_10.1, yelp-xsl 3.28.0-2.el8_10.1, yelp-libs 3.28.1-3.el8_10.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:7569
  • Red Hat Enterprise Linux AppStream (v. 9) yelp 40.3-2.el9_6.1, yelp-libs 40.3-2.el9_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:7430
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) yelp 3.28.1-3.el8_2.1, yelp-libs 3.28.1-3.el8_2.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4457
show 12 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) yelp 3.28.1-3.el8_4.1, yelp-libs 3.28.1-3.el8_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4451
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) yelp 3.28.1-3.el8_6.1, yelp-libs 3.28.1-3.el8_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4455
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) yelp 3.28.1-3.el8_4.1, yelp-libs 3.28.1-3.el8_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4451
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) yelp 3.28.1-3.el8_6.1, yelp-libs 3.28.1-3.el8_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4455
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) yelp 40.3-2.el9_0.1, yelp-libs 40.3-2.el9_0.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4450
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) yelp 3.28.1-3.el8_8.1, yelp-libs 3.28.1-3.el8_8.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4532
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) yelp 40.3-2.el9_2.1, yelp-libs 40.3-2.el9_2.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4505
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) yelp 40.3-2.el9_4.1, yelp-libs 40.3-2.el9_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4456
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) yelp 3.28.1-3.el8_4.1, yelp-libs 3.28.1-3.el8_4.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4451
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) yelp 3.28.1-3.el8_6.1, yelp-libs 3.28.1-3.el8_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:4455
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) yelp-devel 40.3-2.el9_6.1, yelp-debuginfo 40.3-2.el9_6.1, yelp-debugsource 40.3-2.el9_6.1, yelp-libs-debuginfo 40.3-2.el9_6.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:7430
  • Red Hat Enterprise Linux CRB (v. 8) yelp-devel 3.28.1-3.el8_10.1, yelp-debuginfo 3.28.1-3.el8_10.1, yelp-debugsource 3.28.1-3.el8_10.1, yelp-libs-debuginfo 3.28.1-3.el8_10.1
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:7569

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

13.12% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • gist.github.com https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2 referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2357091 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

  • gitlab.gnome.org yelp
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.