CVE-2025-0712

HIGH

Elastic APM Server 8.16-8.16.1 and 8.17 - Local Privilege Escalation via Insecure Directory Permissions

Title source: llm
STIX 2.1

Description

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.

References (1)

Core 1

Scores

CVSS v3 7.0
EPSS 0.0012
EPSS Percentile 2.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-427
Status published
Products (2)
Elastic/APM Server 8.16 - 8.16.2
Elastic/APM Server 8.17 - 8.17.0
Published Jul 30, 2025
Tracked Since Feb 18, 2026