Vulnerability · Published Jun 26, 2025 · Assigned by GitHub_M
CVE-2025-52555CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS
Medium 6.5
In plain English
A medium-severity privilege mismanagement in ceph from ceph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ceph | 16.2.15+ds-0+deb12u2 | DEBIAN-CVE-2025-52555 |
| Debian:13 | ceph | 18.2.6-1 | DEBIAN-CVE-2025-52555 |
| Debian:14 | ceph | 18.2.6-1 | DEBIAN-CVE-2025-52555 |
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N