CVE-2025-6776

HIGH

xiaoyunjie openvpn-cms-flask < 1.2.8 - Path Traversal via Image Upload Parameter

Title source: llm
STIX 2.1

Description

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.314092
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.314092
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.602374
Exploit, Issue Tracking, Vendor Advisory exploit issue-tracking
https://github.com/xiaoyunjie/openvpn-cms-flask/issues/23

Scores

CVSS v3 7.3
EPSS 0.0062
EPSS Percentile 44.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
xiaoyunjie/openvpn-cms-flask < 1.2.8
Published Jun 27, 2025
Tracked Since Feb 18, 2026