CVE-2025-25011
Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
- State
- Published
- Severity
- 7.0 High
- Published
- Jul 30, 2025
- Updated
- Feb 26, 2026
- Reserved
- Jan 31, 2025
Description
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | elastic |
Weaknesses
- CWE-427 Uncontrolled Search Path Element
Affected Products
| Product | Versions |
|---|---|
BeatsElastic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.