# Beats (Windows Installer) 8.18.6, 8.19.3, 9.0.6, & 9.1.0 Security Update (ESA-2025-12)

**URL:** https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558
**Category:** Security Announcements
**Created:** [July 29, 2025, 11:32pm UTC](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558 "2025-07-29T23:32:46Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)
#### Post date: [July 29, 2025, 11:32pm UTC](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558/1 "2025-07-29T23:32:46Z")

</div>

#### Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (ESA-2025-12)

An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.

### Affected Versions:

Beats up to and including `8.18.5`, from version `8.19.0` up to and including `8.19.2`, from version `9.0.0` up to and including `9.0.5`.

### Affected Configurations:

The issue only affects Beats when installed through the install-service script for Windows. Example when installing [Filebeat](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-installation-configuration#installation)using `.\install-service-filebeat.ps1`.

Note: Elastic Agent is **NOT** affected because the Beats are installed in a different path `C:\Program Files\Elastic\Agent`

### Solutions and Mitigations:

The issue is resolved in version 9.1.0.

A maintenance release will be made available for versions 8.18.6, 8.19.3, and 9.0.6.

### **For Users that Cannot Upgrade:**

To resolve the issue for users that cannot upgrade, Beats can be uninstalled and re-installed using the install script from a patched version.

Note: Beats keeps its state in the data path. When re-installing Beats, users need to make sure they have permissions to move the Beats data folder to the new location in `C:\Program Files`. The new installation script will move the data folder. In the event the script fails, the user will need to manually copy the data folder - this is likely due to permission error.

#### **Step-by-step using Filebeat as an example:**

1. Download the latest Filebeat (e.g. 9.1.1)
2. Start a Powershell as administrator
3. Stop the Filebeat service: `stop-service filebeat`
4. Extract the downloaded filebeat: Expand-Archive `.\filebeat-9.1.1-windows-x86_64.zip`
5. Copy the install script onto the current Filebeat installation: `cp .\filebeat-9.1.1-windows-x86_64\filebeat-9.1.1-windows-x86_64\install-service-filebeat.ps1 'C:\Program Files\Filebeat\install-service-filebeat.ps1'`
6. Uninstall the Windows service: `.\uninstall-service-filebeat.ps1`
7. Re-install using the new script: `'C:\Program Files\Filebeat\install-service-filebeat.ps1'`

**Severity** : CVSSv3.1: 7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

**CVE ID** : CVE-2025-25011

### Acknowledgements:

We would like to thank Bocheng Xiang([@Crispr](https://hackerone.com/crispr)) From FDU for responsibly disclosing this vulnerability to Elastic

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

### Change log

2025-08-21:

- Updated “Affected Verions” to coincide with the maintenance releases
- Updated wording on the “Affected Configurations” to clearly state this is caused by the Windows install script. Stated that Elastic Agent is not affected
- Updated “Solutions and Mitigations” to include the maintenance release versions
- Added section “For Users that Cannot Upgrade” with guidance on how to use the patched install script with an older version of the product