PT-2025-41299 · Opencast · Opencast

Lkiesow · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-61906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 17.8 Opencast versions prior to 18.2

Description Opencast is a platform for managing educational audio and video content. In certain scenarios, prior to versions 17.8 and 18.2, the editor could publish a video without user notification. This could result in the accidental publication of internal media, potentially exposing it. The likelihood of this occurring is considered very low, requiring users with write access to an event to use the editor and specifically click "Save & Publish" before selecting "Save".

Recommendations Update to Opencast version 17.8 or later. Update to Opencast version 18.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-61906

GHSA-X6VW-P693-JJHV

Affected Products

Opencast

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61906.json · Exploit
• 🔥 https://github.com/opencast/opencast-editor/issues/1626 · Exploit
• https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv · Vendor Advisory
• https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91 · Patch
• https://osv.dev/vulnerability/CVE-2025-61906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61906 · Security Note
• https://t.me/CVEtracker/34472 · Telegram Post
• https://twitter.com/CVEnew/status/1975997129563787609 · Twitter Post