CVE-2026-25825 describes a security issue in Keyfactor SignServer prior to version 7.6.0 where the output file path used by SignerStatusReportWorker for logging reports can be set to any location. Because this path can point to existing files, an administrative user can overwrite arbitrary files on the server filesystem, including those accessible by the local JBoss user. This vulnerability arises from insufficient validation or restriction on the log output file path setting.

An attacker with administrative privileges on the Keyfactor SignServer can write or overwrite arbitrary files on the server filesystem. This could lead to unauthorized modification or replacement of files accessible by the local JBoss user, potentially impacting system integrity or enabling further attacks. There is no indication of remote exploitation or exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor configuration changes related to log file paths.