CVE-2025-64343 - CVE House
Back to Database
Status published High CVE-2025-64343

(conda) Constructor: Excessive permissions during and after installation

Vulnerability Description

(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64343

Credits & Attribution

No credits recorded in the NVD database.

References

More from conda

View All →
CVE-2025-49823
Conda Constructor Command Injection via Unsanitized User Input (Low)
Unknown 0
CVE-2025-32800
Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI
High 7.2
CVE-2025-32799
Conda-build Vulnerable to Path Traversal via Malicious Tar File
Medium 5.6
CVE-2025-32798
Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors
High 8.2
CVE-2025-32797
Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution
Medium 6

Affected Vendor

Affected Software

constructor
Vulnerable Versions:
< 3.13.0

Timeline

Official Publish: November 7th, 2025
Last Modified: November 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-289

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.