PT-2025-9270 · Unknown · Oxidized-Web

Jamie Riden + 1 · Published 2025-03-03 · Updated 2025-05-31 · CVE-2025-27590

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions oxidized-web versions prior to 0.15.0

Description The issue allows an unauthenticated user to gain control over the Linux user account running the software through the RANCID migration page.

Recommendations For versions prior to 0.15.0, update to version 0.15.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the RANCID migration page until the update is applied.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27590

GHSA-JX6P-9C26-G373

Affected Products

Oxidized-Web

References · 20

• https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27590 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27590 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jx6p-9c26-g373 · Vendor Advisory
• https://github.com/ytti/oxidized-web · Note
• https://github.com/ytti/oxidized-web/releases/tag/0.15.0 · Note
• https://twitter.com/rubylandnews/status/1897019264751501673 · Twitter Post
• https://twitter.com/CVEnew/status/1896414944981323837 · Twitter Post
• https://t.me/latest_high_impact_cve/1899 · Telegram Post
• https://twitter.com/devoo1337/status/1928836394337669541 · Twitter Post
• https://t.me/cvedetector/19305 · Telegram Post
• https://twitter.com/cracbot/status/1898327960731721962 · Twitter Post
• https://t.me/cvenotify/113057 · Telegram Post
• https://t.me/purp_sec/499 · Telegram Post
• https://twitter.com/cracbot/status/1897965577567977573 · Twitter Post