Vulnerability · Published Oct 27, 2025 · Assigned by VulDB
CVE-2025-12250OpenWGA TMLScript API WGA.File path traversal
Medium 4.7
In plain English
A medium-severity path traversal in OpenWGA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-329921 | OpenWGA TMLScript API WGA.File path traversal vdb-entry
- VDB-329921 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #673917 | OpenWGA OpenWGA Admin Client 7.11.12 (Build 737) Code Injection third-party-advisory
- https://github.com/mikecole-mg/security_findings/blob/main/openwga/openwga-rce.md exploit