CVE-2025-50675 – Insecure Permissions in GPMAW 14.2
Summary
CVE-2025-50675 affects GPMAW 14.2, a bioinformatics software developed by Lighthouse Data. The installer creates the folder C:\Program Files\gpmaw with full control granted to the 'Everyone' group, allowing any local user to modify files in the directory.
Affected Product
Vulnerability Type
- Insecure Permissions
- CWE-276: Incorrect Default Permissions
Attack Vector
- Local attackers with user access can replace critical executables, such as the uninstaller (
GPsetup64_17028.exe), with a malicious payload.
- When an administrator runs the uninstaller, the payload executes with elevated privileges.
- Alternatively, attackers can replace components within the installation folder that are executed when the application starts, resulting in persistence on the system.
Impact
- Privilege Escalation
- Arbitrary Code Execution
- Persistence (if executable replaced in user context)
Proof of Concept
- As a standard user, navigate to
C:\Program Files\gpmaw
- Replace
GPsetup64_17028.exe with a malicious executable
- Delete components to cause errors
- Wait for an administrator to run the uninstaller
- The malicious payload runs with administrative privileges
Mitigation
- Restrict permissions on the installation folder so only trusted users (e.g. Administrators) have write access
- Reinstall GPMAW in a secured location with correct ACLs
CVE ID
lukesec/cve-2025-50675-gpmaw-permissions
