CVE-2025-25011

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.

• CWE-427

• https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558

Published

Jul 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25006Improper handling of additional special element in Microsoft…5.3
• CVE-2025-25007Improper validation of syntactic correctness of input in Mic…5.3
• CVE-2025-25008Improper link resolution before file access ('link following…7.1
• CVE-2025-25009Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-2501An untrusted search path vulnerability was reported in Lenov…8.5
• CVE-2025-25010Incorrect authorization in Kibana can lead to privilege esca…6.5
• CVE-2025-25012URL redirection to an untrusted site ('Open Redirect') in Ki…5.4
• CVE-2025-25013Improper restriction of environment variables in Elastic Def…6.5
• CVE-2025-25014A Prototype pollution vulnerability in Kibana leads to arbit…9.8
• CVE-2025-25015Prototype pollution in Kibana leads to arbitrary code execut…9.9
• CVE-2025-25016Unrestricted file upload in Kibana allows an authenticated a…4.3
• CVE-2025-25017Improper Neutralization of Input During Web Page Generation …6.1