CVE-2025-27446: Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-06 · updated 2026-06-17
Weakness: CWE-732

Description

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Affected products

Apache Software Foundation Apache APISIX: from 0.2 through 0.5

References

https://lists.apache.org/thread/qwxnxolt0j5nvjfpr0mlz6h7nrtvyzng
http://www.openwall.com/lists/oss-security/2025/07/06/1
http://www.openwall.com/lists/oss-security/2025/07/07/1

Get alerted when CVE-2025-27446 or the next vulnerability affects your stack