What’s Vulnerable › Vulnerabilities
CVE-2025-25011: Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-30 · updated 2026-06-17
- Weakness: CWE-427
Description
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
Affected products
- Elastic Beats: from 8.0.0 before 9.1.0 — fixed in 9.1.0
How to fix
Upgrade to a fixed version: Elastic Beats 9.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-25011 or the next vulnerability affects your stack