CVEs-PoC/2025/CVE-2025-6000.md

CVE-2025-6000

Description

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

POC

Reference

No PoCs from references.

Github

• https://github.com/EGI-Federation/SVG-advisories
• https://github.com/cyatasec/OuttieFinder
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/samgabrail/vault-in-vmware