CVE-2025-27446: Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).
Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.
Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27446?
CVE-2025-27446 is classified as a high severity vulnerability due to its potential for privilege escalation.
How does CVE-2025-27446 affect Apache APISIX?
CVE-2025-27446 allows local attackers to gain elevated privileges due to incorrect permissions in the local listening file of the Apache APISIX java-plugin-runner.
How do I fix CVE-2025-27446?
To mitigate CVE-2025-27446, update Apache APISIX (java-plugin-runner) to version 0.5.0 or later, ensuring proper file permissions.
What versions of Apache APISIX are affected by CVE-2025-27446?
CVE-2025-27446 affects Apache APISIX (java-plugin-runner) versions from 0.2.0 to 0.5.0, inclusive.
Who is impacted by CVE-2025-27446?
Any user or organization using the affected versions of Apache APISIX (java-plugin-runner) is at risk of privilege escalation due to CVE-2025-27446.