CVE-2025-56499

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Nov 18, 2025

CISA due date

—

The record

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file.

Affected packages

Ecosystem	Package	Introduced	Fixed