# CVE-2025-25011: Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

> CVE-2025-25011: Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer. CVSS 7.0 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-25011
Last updated: 2026-06-17T08:59:59Z

- Published: 2025-07-30 00:15 UTC · Updated: 2026-06-17 08:59 UTC · Assigner: elastic
- CVSS: 7.0 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.15%, 4th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-427

## Description

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.

## Affected vendors and products

- Elastic: Beats

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-25011)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-25011)
- [https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558](https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-25011 · Markdown: https://rewindex.com/cve/CVE-2025-25011.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-25011 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:36.454Z