Skip to main content

Apisix CVE-2025-27446

| EUVDEUVD-2025-20132 HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2025-07-06 security@apache.org
Apache Information Disclosure Apisix
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 16, 2026 - 03:31 euvd
EUVD-2025-20132
Analysis Generated
Mar 16, 2026 - 03:31 vuln.today
CVE Published
Jul 06, 2025 - 06:15 nvd
HIGH 7.8

DescriptionCVE.org

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Analysis

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment for Critical Resource (CWE-732).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Apisix

View all
CVE-2020-13945 MEDIUM POC
6.5 Dec 07

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Rated medium sev
CVE-2021-43557 HIGH POC
7.5 Nov 22

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. Rated high severity (CVSS 7.
CVE-2022-25757 CRITICAL
9.8 Mar 28

In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as
CVE-2022-29266 HIGH
7.5 Apr 20

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the er
CVE-2024-32638 MEDIUM
6.3 May 02

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forwa
CVE-2025-46647 MEDIUM
5.3 Jul 02

CVE-2025-46647 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management proce

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2025-27446 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy