nfpm vulnerable to Incorrect Default Permissions
Priority HIGH 66CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nfpm (goreleaser): 2.29.0github.com/goreleaser/nfpm/v2 (Go): 2.29.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| goreleaser | nfpm | 2.0.0 to before 2.29.0; 0.1.0 to before 2.29.0 | 2.29.0 | Patch available | CNA |
| — | github.com/goreleaser/nfpm/v2 (Go) | 2.0.0 to before 2.29.0 | 2.29.0 | Patch available | GHSA-w7jw-q4fg-qc4c |
| — | github.com/goreleaser/nfpm (Go) | 0.1.0 – 1.10.3 | — | No fix listed | GHSA-w7jw-q4fg-qc4c |
- nfpm Vendorgoreleaser Affected 2.0.0 to before 2.29.0; 0.1.0 to before 2.29.0 Fixed in 2.29.0 Patch available CNA
- github.com/goreleaser/nfpm/v2 (Go) Vendor— Affected 2.0.0 to before 2.29.0 Fixed in 2.29.0 Patch available GHSA-w7jw-q4fg-qc4c
- github.com/goreleaser/nfpm (Go) Vendor— Affected 0.1.0 – 1.10.3 Fixed in — No fix listed GHSA-w7jw-q4fg-qc4c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:goreleaser:nfpm:*:*:*:*:*:*:*:* | 0.1.0 to before 2.29.0 | Vulnerable | goreleaser |
- cpe:2.3:a:goreleaser:nfpm:*:*:*:*:*:*:*:* Versions 0.1.0 to before 2.29.0 Vulnerable ·goreleaser
Remediation
- Fix · CNA nfpm (goreleaser) Fixed in 2.29.0
- Fix · GHSA-w7jw-q4fg-qc4c github.com/goreleaser/nfpm/v2 (Go) Fixed in 2.29.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32698
- 2026-10-03 Alias added: GHSA-w7jw-q4fg-qc4c
References
Sources
- CVE-2023-32698 · CVE Program
- CVE-2023-32698 · NVD
- FIRST EPSS
- GHSA-w7jw-q4fg-qc4c · GitHub Advisory Database · CC BY 4.0
- CVE-2023-32698 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences