CVE-2025-3908: Openvpn OPENVPN3LINUX

Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days.

The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.

Affected products

• Openvpn OPENVPN3LINUX: from 20, up to and including 24

Published 2025-05-19. Last modified 2026-06-17.