CVE Daily

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a direct...

Critical CVSS 9.1

Overview

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.

CWE: CWE-22 Published: 2025-04-03T13:15:42.773
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.1 (CRITICAL)
  • Detected tags: path (tag impact: MODERATE)

Recommended actions:

  • Canonicalize path; block `..` traversal; use allowlists.

Recommended tools

Tags