This vulnerability involves incorrect default permissions on the /etc/passwd file in some Red Hat Process Automation Manager 7 container images. Specifically, the file is group-writable, allowing users in the root group who can execute commands inside the container to alter /etc/passwd. By adding a new user with UID 0, an attacker can escalate privileges to root within the container environment. The CVSS 3.1 score is 6.4 (medium severity), reflecting the requirement for high privileges (root group membership) and local access to the container.

Successful exploitation allows an attacker with existing command execution and root group membership inside the container to escalate privileges to full root within that container. This could lead to unauthorized administrative control over the containerized environment. There is no indication of impact beyond the container boundary or on the host system. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-58713 for current remediation guidance. Until an official fix is available, restrict membership in the root group within containers and avoid running untrusted code with such privileges. Review container build processes to ensure /etc/passwd permissions are correctly set to prevent group-writable access.