A security vulnerability has been discovered in Gradle, a popular open-source build automation tool used for building, testing, and deploying software applications. The vulnerability, tracked as CVE-2025-27148 and assigned a CVSS score of 8.8, could allow a local attacker to escalate their privileges on a compromised system.
The vulnerability stems from how Gradle interacts with the system’s temporary directory on Unix-like systems. “On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it,” the Gradle security advisory explains. This can be exploited by an attacker who can quickly delete and recreate files in the system temporary directory, potentially manipulating Gradle builds to gain elevated privileges.
Specifically, Gradle 8.12 is affected due to certain code paths that rely on copying binaries to the system temporary directory during initialization. “Any execution of Gradle exposed this exploit,” the advisory warns.
Fortunately, users on Windows or modern versions of macOS are not vulnerable to this issue. Similarly, systems with the “sticky” bit set or “noexec” on the system temporary directory are also not vulnerable.
The Gradle project has addressed CVE-2025-27148 in versions 8.12.1 and 8.13. Users of Gradle 8.12 are strongly encouraged to upgrade to one of these versions to mitigate the risk of exploitation.
For those unable to immediately upgrade, Gradle provides workarounds to mitigate the vulnerability. These include setting the “sticky” bit on the system temporary directory or moving the Java temporary directory to a location with more restrictive permissions.
Developers and system administrators using Gradle should prioritize updating to the latest version or implementing the recommended workarounds to ensure their systems are secure.
