CVE-2025-27446
HIGHApache APISIX(java-plugin-runner) - Privilege Escalation
Title source: llmDescription
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.
Scores
CVSS v3
7.8
EPSS
0.0001
EPSS Percentile
2.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-732
Status
published
Affected Products (1)
apache/apisix
< 0.5
Timeline
Published
Jul 06, 2025
Tracked Since
Feb 18, 2026