ytti/oxidized-web · Security
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account
- GHSA ID
- GHSA-jx6p-9c26-g373
- CVE ID
- CVE-2025-27590
- Severity
- critical
- Published
- Updated
- CVSS
- 9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')