PT-2025-40351 · Exim · Exim

Matthias Gerstner · Published 2025-10-02 · Updated 2025-12-30 · CVE-2025-53881

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions exim versions prior to 4.98.2-lp156.248.1

Description A flaw exists in the exim package related to a UNIX Symbolic Link (Symlink) Following vulnerability within the logrotate configuration. This issue allows for privilege escalation from the mail user/group to root.

Recommendations Update to exim version 4.98.2-lp156.248.1 or later.

Fix

LPE

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2025-53881

OPENSUSE-SU-2025:15626-1

OPENSUSE-SU-2025:20155-1

Affected Products

Exim

References · 8

• https://osv.dev/vulnerability/openSUSE-SU-2025:20155-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53881 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15626-1 · Vendor Advisory
• https://bugzilla.suse.com/1246457 · Note
• https://twitter.com/VulmonFeeds/status/1973780824014152129 · Twitter Post
• https://twitter.com/CVEnew/status/1973753683633402119 · Twitter Post
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53881 · Note
• https://suse.com/security/cve/CVE-2025-53881 · Note