{"id":"CVE-2025-53881","aliases":["EUVD-2025-32655","GHSA-mj4q-r4hv-qwvc","openSUSE-SU-2025:15626-1","openSUSE-SU-2025:20155-1"],"status":"published","title":"SUSE-specific logrotate configuration allows escalation from mail user/group to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00168,"percentile":0.06216,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2025-10-02T13:51:56Z","modified":"2026-10-12T15:10:00Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"exim","fixed_in":["4.98.2-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"exim","fixed_in":["4.98.2-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98.2-bp160.2.1"}]}]}],"products":[{"vendor":"opensuse","product":"tumbleweed"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53881"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53881"},{"url":"https://github.com/advisories/GHSA-mj4q-r4hv-qwvc"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53881","tags":["web"]},{"url":"https://bugzilla.suse.com/1246457","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-53881","title":"SUSE-specific logrotate configuration allows escalation from mail user/group to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.","status":"published","published":"2025-10-02T13:51:56.848Z","modified":"2025-10-02T17:38:57.426Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-32655","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.","status":"published","published":"2025-10-02T13:51:56Z","modified":"2025-10-02T17:38:57Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:36.727084Z"}],"ghsa":[{"id":"GHSA-mj4q-r4hv-qwvc","title":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package...","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.","status":"published","published":"2025-10-02T15:31:16Z","modified":"2025-10-02T15:31:17Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:03:50.19975Z"}],"nvd":[{"id":"CVE-2025-53881","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.","status":"published","published":"2025-10-02T14:15:45.01Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"openSUSE-SU-2025:15626-1","title":"exim-4.98.2-4.1 on GA media","description":"These are all security issues fixed in the exim-4.98.2-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-13T00:00:00Z","modified":"2026-03-23T04:54:01.258631Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20155-1","title":"Security update for exim","description":"This update for exim fixes the following issues:\n\n- CVE-2025-53881: Fixed a potential security issue with logfile rotation (bsc#1246457)\n","status":"published","published":"2025-12-30T17:02:44Z","modified":"2026-03-23T04:54:18.706144Z","updated_at":"2026-11-02T16:58:38.101535Z"}]}}