CVE-2025-53881

A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.

CVSS

No CVSS.

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53881

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de seguimiento de enlace simbólico (Symlink) de UNIX en la configuración de logrotate en el paquete exim permitió la escalada de privilegios desde el usuario/grupo de correo a root. Este problema afecta a Tumbleweed: desde ? antes de 4.98.2-lp156.248.1.

Information

Published : 2025-10-02 14:15

Updated : 2026-10-12 15:10

NVD link : CVE-2025-53881

Mitre link : CVE-2025-53881

CVE.ORG link : CVE-2025-53881

JSON object : View

Products Affected

No product.

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2025-53881", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53881", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-02T17:15:08.115894Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"vendor": "openSUSE", "product": "Tumbleweed", "versions": [{"status": "affected", "version": "?", "lessThan": "4.98.2-lp156.248.1", "versionType": "semver"}], "packageName": "exim", "defaultStatus": "unaffected"}]}], "published": "2025-10-02T14:15:45.010", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53881", "source": "meissner@suse.de"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1."}, {"lang": "es", "value": "Una vulnerabilidad de seguimiento de enlace simb\u00f3lico (Symlink) de UNIX en la configuraci\u00f3n de logrotate en el paquete exim permiti\u00f3 la escalada de privilegios desde el usuario/grupo de correo a root. Este problema afecta a Tumbleweed: desde ? antes de 4.98.2-lp156.248.1."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "meissner@suse.de"}