CVE-2025-55202

LOW EPSS 27.8%
Published Aug 29, 202510mo ago · Modified Jun 17, 20262w ago
2.7 CVSS 4.0
Low
Find Similar
Published Aug 29, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.

CVSS Details

Base Score
2.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
27.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-23

Affected Products 2

VendorProductVersionRange
apereoopencast* <17.7
apereoopencast18.0any

References 3

  • github.com https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009
    Patch
  • github.com https://github.com/opencast/opencast/pull/6979
    Patch
  • github.com https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8
    Third Party Advisory

Remediation

  • github.com https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009
    Patch
  • github.com https://github.com/opencast/opencast/pull/6979
    Patch