bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-bitcoin | Aug 22, 2024 | Jan 21, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 21, 2021 | |
| Suse | — | suse-upgrade-bitcoin-qt5suse-upgrade-bitcoin-testsuse-upgrade-bitcoin-utilssuse-upgrade-bitcoindsuse-upgrade-libbitcoinconsensus-develsuse-upgrade-libbitcoinconsensus0 | Mar 4, 2022 | Jan 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub