High severity · published Jul 30, 2025
CVE-2025-25011
Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
7.0
CVSS
0.2%
EPSS
No
On KEV
Description
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
Beats · Elastic
8.0.0 before 9.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25011
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25011
discuss.elastic.co
https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558
More from Beats
7.5
CVE-2023-31421
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
6.5
CVE-2023-49922
Beats Insertion of Sensitive Information into Log File