Local Privilege Escalation Vulnerability in Gradle's Native-Platform Tool
CVE-2025-27148

8.8HIGH

Key Information:

Vendor: Gradle
Status: Gradle
Vendor: CVE Published:; 25 February 2025

What is CVE-2025-27148?

CVE-2025-27148 is a local privilege escalation vulnerability affecting Gradle's native-platform tool, which is a build automation solution widely used for Java applications. This vulnerability arises when the tool initializes its libraries using insecure file paths in the system's temporary directory on Unix-like operating systems. If exploited, it could allow an attacker to manipulate files during the build process, potentially leading to unauthorized access and control over the system, posing a significant risk to organizations that rely on Gradle for their build processes.

Technical Details

The vulnerability occurs in versions of the Gradle native-platform tool prior to 0.22-milestone-28. When the Native.get(Class<>) method is invoked without prior proper initialization using Native.init(File), it defaults to using the system's temporary directory. This can lead to an attacker rapidly creating and deleting files, enabling a local privilege escalation scenario. Affected Gradle builds, specifically those tied to the Gradle version 8.12, are particularly vulnerable as this version included code paths that utilized this flawed initialization process. The issue has been addressed in newer versions of Gradle, including 8.12.1 and beyond.

Potential impact of CVE-2025-27148

Unauthorized Access: Exploiting this vulnerability could allow an attacker to gain unauthorized access to system resources, compromising sensitive data and potentially leading to unauthorized actions within the environment.
System Compromise: By leveraging privilege escalation, assailants could execute arbitrary code, causing extensive harm to the organization’s infrastructure, including data manipulation, destruction, or installation of malware.
Impacts on Development Processes: As Gradle is integral to the build automation in Java projects, a successful exploit could disrupt development workflows, potentially leading to delays, reputational damage, and increased costs for incident response and remediation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch