Vulnerability · Published Mar 3, 2025 · Assigned by mitre
CVE-2025-27590
Critical 9.0
In plain English
A critical-severity path traversal in Oxidized Web from Oxidized Web project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.6% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)27.6%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | oxidized-web | 0.15.0 | GHSA-jx6p-9c26-g373 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oxidized Web project | Oxidized Web | 0 – before 0.15.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H