CVE-2025-0651: Cloudflare WARP Privilege Escalation Flaw

CVE-2025-0651 Overview

CVE-2025-0651 is an Improper Privilege Management vulnerability [CWE-269] in Cloudflare WARP on Windows. A local user with low system privileges can plant symbolic links in the C:\ProgramData\Cloudflare\warp-diag-partials directory. When the user triggers the Reset all settings option, the WARP service follows those symlinks and deletes the target files. Because the WARP service runs with SYSTEM privileges, an attacker can delete files owned by the SYSTEM account. The issue affects Cloudflare WARP releases prior to 2024.12.492.0.

Critical Impact
A low-privileged local user can leverage symlink redirection to delete arbitrary SYSTEM-owned files, enabling denial of service and potential local privilege escalation on Windows hosts.

Affected Products

Cloudflare WARP for Windows versions prior to 2024.12.492.0
Windows endpoints running the Cloudflare WARP client service
Deployments using WARP diagnostics in the C:\ProgramData\Cloudflare\warp-diag-partials path

Discovery Timeline

2025-01-22 - CVE-2025-0651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0651

Vulnerability Analysis

The vulnerability resides in the Cloudflare WARP Windows service, which runs under the SYSTEM account. The service uses the C:\ProgramData\Cloudflare\warp-diag-partials directory to store diagnostic artifacts. This directory inherits permissions that allow standard users to write to it. When a user selects Reset all settings from the WARP client, the service enumerates and deletes files in this directory without validating whether entries are legitimate files or symbolic links pointing elsewhere on disk.

By placing crafted symlinks in the directory before triggering the reset, a low-privileged attacker redirects the deletion primitive to arbitrary file paths. The service performs the delete operation with SYSTEM rights, bypassing the access controls that would normally protect files owned by the operating system or other privileged services.

This class of flaw is a classic symlink-following weakness combined with improper privilege management, tracked as [CWE-269].

Root Cause

The root cause is the WARP service performing file deletion in a user-writable directory without resolving or rejecting symbolic links before the operation. The service trusts filesystem entries in warp-diag-partials and executes deletions in the context of the SYSTEM account.

Attack Vector

Exploitation requires local access with a standard user account and user interaction to trigger Reset all settings. The attacker first creates one or more symbolic links inside C:\ProgramData\Cloudflare\warp-diag-partials, each pointing to a file the attacker wishes to destroy. When the reset routine executes, the service deletes the linked targets. Attackers can use this primitive to remove critical system files, corrupt security tooling, or stage a DLL-hijack scenario that leads to local privilege escalation.

No verified public proof-of-concept code is available. The mechanism is described in prose per the Cloudflare advisory referenced in the Cloudflare WARP Client Documentation.

Detection Methods for CVE-2025-0651

Indicators of Compromise

Presence of symbolic links or junctions inside C:\ProgramData\Cloudflare\warp-diag-partials created by non-administrative users
Unexpected deletion of files owned by NT AUTHORITY\SYSTEM shortly after WARP client reset activity
WARP service event log entries indicating diagnostic reset actions from standard user sessions

Detection Strategies

Monitor mklink or CreateSymbolicLink/NtCreateFile reparse point operations targeting the WARP diagnostics directory
Alert on file deletion events performed by the WARP service where the target path resides outside C:\ProgramData\Cloudflare
Correlate WARP client Reset all settings invocations with SYSTEM-context deletions of protected paths

Monitoring Recommendations

Enable Windows object access auditing on C:\ProgramData\Cloudflare\warp-diag-partials to log create and delete events
Forward Sysmon Event IDs 11 (FileCreate) and 23 (FileDelete) to a central analytics pipeline for the WARP directory
Track installed WARP client versions across the fleet and flag hosts below 2024.12.492.0

How to Mitigate CVE-2025-0651

Immediate Actions Required

Upgrade Cloudflare WARP for Windows to version 2024.12.492.0 or later on all endpoints
Inventory Windows hosts running WARP and prioritize systems where standard users have interactive logon rights
Restrict end-user permissions on the C:\ProgramData\Cloudflare\warp-diag-partials directory where feasible

Patch Information

Cloudflare addressed the issue in WARP for Windows version 2024.12.492.0. Refer to the Cloudflare WARP Client Documentation for release notes and deployment guidance. Managed deployments should use the Zero Trust dashboard to enforce the fixed client version.

Workarounds

Prevent non-administrative users from invoking the Reset all settings option through group policy or MDM configuration
Remove standard-user write access to C:\ProgramData\Cloudflare\warp-diag-partials until the patched build is deployed
Disable the WARP client on high-value hosts where the fix cannot be applied immediately

bash

# Verify installed WARP version on Windows
warp-cli --version

# Query ACLs on the vulnerable diagnostics directory
icacls "C:\ProgramData\Cloudflare\warp-diag-partials"

# Remove inherited write permission for standard users (interim mitigation)
icacls "C:\ProgramData\Cloudflare\warp-diag-partials" /inheritance:d
icacls "C:\ProgramData\Cloudflare\warp-diag-partials" /remove:g "BUILTIN\Users"