PT-2025-26622 · Unknown+1 · Clickhouse+1

Seth Kraft · Published 2025-06-23 · Updated 2025-06-24 · CVE-2025-52969

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ClickHouse version 25.7.1.557

Description: The issue allows low-privileged users to execute shell commands by querying existing Executable() tables created by higher-privileged users. There is no access control preventing low-privileged users from invoking Executable tables already present in the system. If an attacker can influence the contents of the script referenced by the Executable() engine through writable paths, they may execute controlled commands in the context of the ClickHouse server, leading to privilege escalation and unauthorized code execution.

Recommendations: For ClickHouse version 25.7.1.557, consider restricting access to existing Executable() tables to prevent low-privileged users from invoking them, or remove the Executable() tables if they are not necessary. As a temporary workaround, consider restricting writable paths that could be used to influence the script referenced by the Executable() engine.

Exploit

Fix

LPE

Weakness Enumeration

CWE-420

Related Identifiers

CVE-2025-52969

Affected Products

Clickhouse

Debian

References · 10

• 🔥 https://github.com/skraft9/clickhouse-security-research · Exploit
• https://ubuntu.com/security/CVE-2025-52969 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52969 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52969 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52969 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-52969 · Vendor Advisory
• https://twitter.com/CVEnew/status/1937197866390364611 · Twitter Post
• https://twitter.com/skraft09/status/1937248582328811636 · Twitter Post
• https://t.me/cvetracker/26856 · Telegram Post