CVE-2025-13130: Radarr Privilege Escalation Vulnerability

CVE-2025-13130 Overview

CVE-2025-13130 is an insecure default permissions vulnerability in Radarr version 5.28.0.10274, a widely used movie collection management application. The flaw resides in the service component binary located at C:\ProgramData\Radarr\bin\Radarr.Console.exe. Weak file system permissions allow low-privileged local users to modify the executable, enabling privilege escalation when the service runs under elevated context. The weakness is classified as CWE-266: Incorrect Privilege Assignment. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
A local attacker with limited privileges can replace or modify the Radarr service binary to execute arbitrary code with the privileges of the service account, resulting in full loss of confidentiality, integrity, and availability on the host.

Affected Products

Radarr 5.28.0.10274 (Windows installations)
Installations deploying files under C:\ProgramData\Radarr\bin\
Service-mode deployments of Radarr.Console.exe

Discovery Timeline

2025-11-13 - CVE-2025-13130 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13130

Vulnerability Analysis

Radarr installs its service binary at C:\ProgramData\Radarr\bin\Radarr.Console.exe with default file system permissions that grant write access to non-privileged users. The ProgramData directory inherits an access control list that permits standard user modification unless explicitly restricted during installation. When the Radarr service starts under a privileged account, the operating system loads whatever binary resides at that path.

An attacker with local access can overwrite Radarr.Console.exe with a malicious payload. On the next service start or system reboot, the payload runs in the security context of the service account. The issue does not require any authentication step tied to Radarr itself, only local session access with standard user rights.

The vulnerability aligns with CWE-266: Incorrect Privilege Assignment and represents a classic insecure permissions escalation path on Windows.

Root Cause

The root cause is the installer failing to apply a restrictive access control list (ACL) to the bin directory and its contents. Files placed under C:\ProgramData\<app>\ require explicit ACL hardening because the parent directory permits write access to authenticated users by default. Radarr does not enforce write restrictions on the service executable after installation.

Attack Vector

The attack is local and requires low-privileged user access on the host. An attacker overwrites or replaces Radarr.Console.exe with an attacker-controlled binary. Execution occurs when the Radarr service restarts, at system boot, or when triggered by an administrator. Refer to the GitHub CVE Discovery Guide and the VulDB #332361 Report for reproduction context.

Detection Methods for CVE-2025-13130

Indicators of Compromise

Unexpected modification timestamps on C:\ProgramData\Radarr\bin\Radarr.Console.exe
File hash mismatches between the installed binary and the vendor-distributed release
Radarr service processes spawning unrelated child processes such as cmd.exe, powershell.exe, or network utilities
Non-administrative user accounts writing to files under C:\ProgramData\Radarr\bin\

Detection Strategies

Monitor file integrity on the Radarr installation directory and alert on any write operation by non-SYSTEM, non-administrator accounts
Baseline the SHA-256 hash of Radarr.Console.exe after patching and compare on a scheduled interval
Correlate service restart events (Windows Event ID 7036) with recent file writes to the service binary path

Monitoring Recommendations

Enable Windows Security auditing for object access on C:\ProgramData\Radarr\ to log write attempts
Ingest Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash) for the Radarr bin path
Track process creation events where the parent is the Radarr service to detect anomalous child processes

How to Mitigate CVE-2025-13130

Immediate Actions Required

Restrict the ACL on C:\ProgramData\Radarr\bin\ so only Administrators and SYSTEM have write access
Verify the integrity of Radarr.Console.exe against a known-good hash before restarting the service
Run the Radarr service under a dedicated, least-privileged service account rather than SYSTEM where feasible
Audit all local user accounts on hosts running Radarr and remove unnecessary local logon rights

Patch Information

At the time of publication, the vendor has not released a patch and did not respond to disclosure. Monitor the Radarr project releases for updates beyond version 5.28.0.10274. Until a fix is available, apply the workarounds below.

Workarounds

Manually apply restrictive NTFS permissions to the Radarr installation directory using icacls to remove inherited write permissions for Users and Authenticated Users
Deploy application allowlisting (such as Windows Defender Application Control or AppLocker) to prevent execution of modified binaries
Relocate the Radarr installation to a directory outside C:\ProgramData\, such as C:\Program Files\, where default ACLs restrict standard user writes
Limit interactive local logons on servers hosting Radarr to reduce exposure to local attackers

bash

# Configuration example: harden ACLs on the Radarr binary directory
icacls "C:\ProgramData\Radarr\bin" /inheritance:r
icacls "C:\ProgramData\Radarr\bin" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\ProgramData\Radarr\bin" /remove "Users" "Authenticated Users"

# Verify the resulting ACL
icacls "C:\ProgramData\Radarr\bin\Radarr.Console.exe"