CVE-2025-0046

HighCVSS 7.0/10Last modified Sep 29, 2026

Description

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.

Metrics

CVSS 4.0 7.0/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Sep 29, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-00494.3When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes thCVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd ValhaCVE-2025-00518.7Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.CVE-2025-00528.3Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.CVE-2025-00535.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using aCVE-2025-00545.4SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. TheCVE-2025-00556.0SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administratiCVE-2025-00566.0SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�CVE-2025-00574.8SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin caCVE-2025-00586.5In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resourceCVE-2025-00596.0Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usaCVE-2025-00606.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can
CVE-2025-0046: High severity, CVSS 7.0 | Vulnix