High · 7.8 CVE-2025-27446 EUVD-2025-20132GHSA-xm8v-g828-5x9r

Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Published Jul 6, 2025 · Updated Feb 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache APISIX Java Plugin Runner

Description

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges.
This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache APISIX Java Plugin Runner	0.2.0 – ≤ 0.5.0	—

References

https://lists.apache.org/thread/qwxnxolt0j5nvjfpr0mlz6h7nrtvyzng vendor-advisory