PT-2025-35228 · Opencast · Opencast

Opsysdebug · Published 2025-08-29 · Updated 2026-01-19 · CVE-2025-55202

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 17.7 Opencast version 18.0

Description Opencast is a platform for managing educational audio and video content. Insufficient protections against path traversal attacks in the UI config module could allow attackers access to files within another folder that starts with the same path. The path is checked without checking for the file separator.

Recommendations Update to version 17.7 or later. Update to version 18.1 or later. Check for folders that start with the same path as the ui-config folder.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-55202

GHSA-HQ8M-V68G-8CF8

Affected Products

Opencast

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55202.json · Exploit
• https://github.com/opencast/opencast/pull/6979 · Patch
• https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009 · Patch
• https://osv.dev/vulnerability/GHSA-hq8m-v68g-8cf8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55202 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55202 · Vendor Advisory
• https://github.com/opencast/opencast · Note
• https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8 · Note
• https://twitter.com/CVEnew/status/1961456435616710954 · Twitter Post
• https://twitter.com/thomunknowndev/status/2013132024715034831 · Twitter Post