CVE-2025-53881 SUSE-specific logrotate configuration allows escalation from mail user/group to root
A symlink following flaw in the Exim logrotate configuration allows local attackers to escalate privileges from mail user to root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53881?
CVE-2025-53881 is a medium-severity vulnerability in openSUSE Tumbleweed, published on 2 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.
Weakness: CWE-61
Which versions are affected by CVE-2025-53881?
Linux distribution packages (2)
exim openSUSE:Leap 16.0 | All versions | 4.98.2-bp160.2.1 |
exim openSUSE:Tumbleweed | All versions | 4.98.2-4.1 |
How do I fix CVE-2025-53881?
Apply the vendor's patch.
Is CVE-2025-53881 being exploited?
There is no known exploitation of CVE-2025-53881 in the wild and no public exploit code.
Sources
Also known as GHSA-mj4q-r4hv-qwvc, openSUSE-SU-2025:15626-1, openSUSE-SU-2025:20155-1.