This vulnerability arises from incorrect default permissions on the /etc/passwd file in some Red Hat Web Terminal container images. Specifically, the file is created with group-writable permissions during image build, allowing users in the root group who can execute commands inside the container to modify /etc/passwd. This modification can be exploited to add new users with arbitrary user IDs, including UID 0, effectively escalating privileges to root within the container environment. The CVSS 3.1 vector indicates the attack requires local access with high privileges and high attack complexity, but results in high confidentiality, integrity, and availability impact.

An attacker with command execution inside an affected container and membership in the root group can escalate privileges to root by modifying the /etc/passwd file. This leads to full root privileges within the container, potentially compromising container integrity and confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-57853 for current remediation guidance. Until an official fix is available, restrict container access to trusted users and avoid granting root group membership to untrusted users within containers.