Skip to content
Fencer Vulns
medium 6.5

CVE-2025-52555 json

CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS

published 2025-06-26 16 mo ago modified 2026-06-17 4 mo ago also BIT-ceph-2025-52555 , EUVD-2025-19240 , GHSA-89hm-qq33-2fjm

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.

Patch / fix

  • bitnami ceph 17.2.8, 18.2.5, 19.2.3
  • linuxfoundation ceph 17.2.8, 18.2.5, 19.2.3
  • redhat ceph 17.2.8, 18.2.5, 19.2.3
  • ceph Debian 12 16.2.15+ds-0+deb12u2
  • ceph Debian 14, Debian 13 18.2.6-1

debian advisories DEBIAN-CVE-2025-52555

  • ceph ceph storage 7.1 2:18.2.1-381.el8cp
  • ceph ceph storage 7.1 2:18.2.1-381.el9cp
  • cephadm ceph storage 7.1 2:18.2.1-381.el9cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el9cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el8cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el9cp
  • rbd-nbd ceph storage 7.1 2:18.2.1-381.el8cp

red hat advisories RHSA-2026:2769RHSA-2026:1536

  • ceph Azure Linux 3.0 18.2.2-9

azure linux advisories AZL-64386

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-52555 updated cvss 6.5

ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS

  • Red Hat Ceph Storage 4 ceph, librbd1, librgw2, rbd-nbd, ceph-mds, ceph-mgr, +27 more
    affected: workaround, no fix available “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.”
  • Red Hat Ceph Storage 5 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mds, +33 more Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more
    affected: workaround, no fix planned “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.”
  • Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Enterprise Linux 8 librbd1, librados2, libcephfs2, libradosstriper1 Red Hat Enterprise Linux 9 librbd1, librados2 Red Hat Enterprise Linux 10 ceph
    affected: workaround, no fix available “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.”
  • Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1781863705
    fixed: vendor fix “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.” RHSA-2026:33154
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-381.el8cp, ceph 18.2.1-381.el9cp, cephadm 18.2.1-381.el9cp, librbd1 18.2.1-381.el8cp, librbd1 18.2.1-381.el9cp, librgw2 18.2.1-381.el8cp, +37 more
    fixed: vendor fix “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.” RHSA-2026:2769
  • Red Hat Ceph Storage 9.0 Tools cephfs-top 20.1.0-144.el9cp, libcephfs2 20.1.0-144.el9cp, cephfs-top 20.1.0-144.el10cp, libcephfs2 20.1.0-144.el10cp, python3-cephfs 20.1.0-144.el9cp, python3-cephfs 20.1.0-144.el10cp, +2 more
    fixed: vendor fix “Red Hat Product Security does not have any recommended mitigations at this time. Please update as patched versions become available.” RHSA-2026:1536
  • Red Hat Ceph Storage 7.1 rhceph/grafana-rhel9 1781855851, rhceph/keepalived-rhel9 1781855108, rhceph/snmp-notifier-rhel9 1781854814, rhceph/rhceph-haproxy-rhel9 1781856344, rhceph/rhceph-promtail-rhel9 1781856148 Red Hat Ceph Storage 9.0 Tools nvml 2.1.0-3.el10cp, re2 20211101-4.el9cp, ceph 20.1.0-144.el9cp, liborc 2.0.3-2.el10cp, re2 20211101-4.el10cp, thrift 0.15.0-3.el9cp, +63 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
OSV 3.1 6.5 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami ceph
>=17.2.7, <17.2.8
>=18.2.1, <18.2.5
>=19.0.0, <19.2.3
17.2.8
18.2.5
19.2.3

Affected products

  • ceph ceph

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.