Vulnerability Description
A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xiaoyunjie | Openvpn-Cms-Flask | < 1.2.8 |
Related Weaknesses (CWE)
References
- https://github.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c2Patch
- https://github.com/xiaoyunjie/openvpn-cms-flask/issues/23ExploitIssue TrackingVendor Advisory
- https://github.com/xiaoyunjie/openvpn-cms-flask/releases/tag/v1.2.8Release Notes
- https://vuldb.com/?ctiid.314092Permissions RequiredVDB Entry
- https://vuldb.com/?id.314092Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.602374Third Party AdvisoryVDB Entry
FAQ
What is CVE-2025-6776?
CVE-2025-6776 is a vulnerability with a CVSS score of 7.3 (HIGH). A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the compon...
How severe is CVE-2025-6776?
CVE-2025-6776 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-6776?
Check the references section above for vendor advisories and patch information. Affected products include: Xiaoyunjie Openvpn-Cms-Flask.