CVE-2025-5278

Medium

Advisory

Published 27 May 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.4; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,554; of 17,821 indexed, latest versions
Container images: 2,613; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: coreutils security update

Carried by container images the latest versions of 2,554 of 17,821 indexed charts deploy, on 2,613 images.

Affected package	Affected versions	Fixed in	Images
coreutilsdeb	8.21-1ubuntu5, 8.21-1ubuntu5.1, 8.21-1ubuntu5.4, 8.25-2ubuntu2+17 more	8.32-4.1ubuntu1.4, 9.4-3ubuntu6.3, 9.7-3ubuntu2.1	2,440
coreutilsrpm	8.29-lp151.3.3, 8.29-lp152.4.7, 8.32-32.el9, 8.32-34.el9+7 more	0:8.32-41.el9_8, 0:9.5-8.el10_2, 8.32-150400.9.9.1, 9.4-7+1 more	155
coreutils-fromdeb	9.5-1ubuntu2+0.0.0~ubuntu24, 9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	77

OSV records: DEBIAN-CVE-2025-5278 RHSA-2026:28911 RHSA-2026:33124 RLSA-2026:28911 UBUNTU-CVE-2025-5278 AZL-93060 openSUSE-SU-2025:15327-1 SUSE-SU-2025:02362-1
Also known as: USN-8697-1

Charts affected

2,554 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	coreutils@9.1-1	no fix listed

Open the chart page →

2,710

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	coreutils@9.7-3	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	coreutils@8.28-1ubuntu1	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	coreutils@8.30-3ubuntu2	no fix listed

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	coreutils@8.32-4.1ubuntu1.3	8.32-4.1ubuntu1.4

Open the chart page →

7,966

Container images carrying it

2,613 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/memcached :1.6 :1.6.45	75c93cc91e76	coreutils@9.7-3	no fix listed	3
library/nginx :stable	0aa2d81d65bc	coreutils@9.7-3	no fix listed	3
library/nginx :1.25 :1.25.5	a484819eb602	coreutils@9.1-1	no fix listed	3
library/postgres :14	156f0b253fd6	coreutils@9.7-3	no fix listed	3
library/wordpress :7.1.0-apache :latest	5a93c470ae82	coreutils@9.7-3	no fix listed	3
linuxserver/plex :1.43.4 :latest	1f6f97d76e7b	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	3
mcp/grafana :latest	9362bcf6aa0e	coreutils@9.1-1	no fix listed	3
meshery/meshery :stable-latest	44b64ee128fb	coreutils@9.1-1	no fix listed	3
omecproject/cdn-video-repo :1.0.0 :remote-v3	d59ccb138ffb	coreutils@8.25-2ubuntu3~16.04	no fix listed	3
opencsghq/postgres :15.19	b98600564e07	coreutils@9.7-3	no fix listed	3
openebs/node-disk-manager :2.1.0	f6c18b0f8c8a	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	3
openebs/node-disk-operator :2.1.0	6afe2123c457	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	3
selenium/hub :3.141.59	02f251d48d5f	coreutils@8.30-3ubuntu2	no fix listed	3
sigp/lighthouse :latest-amd64	50f66cfebb6d	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	3
vaultwarden/server :1.37.1	ebdfe70701c6	coreutils@9.7-3	no fix listed	3
xenondb/percona :5.7.33	0e26872a2b67	coreutils@8.30-3ubuntu2	no fix listed	3
ghcr.io/api7/adc :0.27.1	f65f53dd9668	coreutils@9.1-1	no fix listed	3
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	coreutils@9.1-1	no fix listed	3
ghcr.io/conductionnl/gateway-ui :stag	6a5594b7b32c	coreutils@9.1-1	no fix listed	3
ghcr.io/dgtlmoon/changedetection.io :0.60.7 :latest	096dae27b5d6	coreutils@9.1-1	no fix listed	3
ghcr.io/donkie/spoolman :0.26.1	cf9b41e17b93	coreutils@9.1-1	no fix listed	3
ghcr.io/flaresolverr/flaresolverr :latest :v3.5.2	c80ae007ce2c	coreutils@9.1-1	no fix listed	3
ghcr.io/huggingface/text-embeddings-inference :cpu-1.5	0502794a4d86	coreutils@9.1-1	no fix listed	3
ghcr.io/smarter-project/hydra/crismux :main	673d5229df1f	coreutils@9.1-1	no fix listed	3
quay.io/cilium/cilium :v1.20.2	2939231d0d3e	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	coreutils@9.1-1	no fix listed	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	3
quay.io/devtron/casbin :172ef62b-9450794d-464-39422	5bf041aacadd	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/chart-sync :94237c18-1021-39419	60566529446a	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/chart-sync :3b3d6d0e-836-39296	721b5c9634d4	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/devtron :9450794d-930-39415	9795f3f9f031	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	coreutils@8.30-3ubuntu2	no fix listed	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	coreutils@8.25-2ubuntu3~16.04	no fix listed	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	coreutils@9.1-1	no fix listed	3
actualbudget/actual-server :26.9.0	552beab3dec8	coreutils@9.1-1	no fix listed	2
alazidis/kube-netlag :1.1.0	0e8c84152201	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	2
apache/nifi-registry :1.26.0	7cdfd8deec92	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	2
apache/rocketmq :5.4.0	319cd8a81ed1	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	2
apacherocketmq/rocketmq-dashboard :2.1.0	ce78506bd6fe	coreutils@8.32-39.el9	0:8.32-41.el9_8	2
apache/tika :2.9.0.0	92d055a84e9e	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	coreutils@9.1-1	no fix listed	2
bitnamilegacy/mariadb :11.4.5-debian-12-r9	33ce23601fc9	coreutils@9.1-1	no fix listed	2
bitnamilegacy/postgresql :16.4.0-debian-12-r14	94bc968141e7	coreutils@9.1-1	no fix listed	2
bitnamilegacy/redis :latest	5927ff3702df	coreutils@9.1-1	no fix listed	2
bitnami/minideb :latest	ab4d5b45116e	coreutils@9.7-3	no fix listed	2