Vulnerability · Published Aug 29, 2025 · Assigned by GitHub_M

CVE-2025-55202Opencast has a partial path traversal vulnerability in UI config

Low 2.7

In plain English

A low-severity security flaw in opencast from opencast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.opencastproject:opencast-user-interface-configuration	17.7	GHSA-hq8m-v68g-8cf8
Maven	org.opencastproject:opencast-user-interface-configuration	18.1	GHSA-hq8m-v68g-8cf8

Affected products (as reported)

Vendor	Product	Versions
opencast	opencast	< 17.7= 18.0

Weakness: CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8 x_refsource_CONFIRM
https://github.com/opencast/opencast/pull/6979 x_refsource_MISC
https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009 x_refsource_MISC