CVE Alert: CVE-2025-52969
Vulnerability Summary: CVE-2025-52969
ClickHouse 25.7.1.557 allows low-privileged users to execute shell commands by querying existing Executable() tables created by higher-privileged users. Although the CREATE TABLE privilege is restricted, there is no access control preventing low-privileged users from invoking Executable tables already present in the system. If an attacker can influence the contents of the script referenced by the Executable() engine through writable paths, they may execute controlled commands in the context of the ClickHouse server, leading to privilege escalation and unauthorized code execution. NOTE: the Supplier’s position is that these types of executions by low-privileged users are the expected behavior.
Affected Endpoints:
No affected endpoints listed.
Published Date:
6/23/2025, 5:15:31 PM
❄️ CVSS Score:
Exploit Status:
Not ExploitedReferences:
- https://github.com/skraft9/clickhouse-security-research
- https://github.com/skraft9/clickhouse-security-research
Recommended Action:
No proposed action available. Please refer to vendor documentation for updates.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
