CVE-2025-27501 Server Side Request Forgery in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side...

CVE-2025-27500 Cross Site Scripting potential in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint/api/upload on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL...

CVE-2025-27500 Cross Site Scripting potential in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint/api/upload on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL...

CVE-2025-27500 Cross Site Scripting potential in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint/api/upload on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL...

CVE-2025-27500

CVE-2025-27500 affects OpenZiti Console. An unauthenticated POST to the admin endpoint /api/upload can upload files stored on the node, which can be accessed to trigger a stored XSS when viewed in a user’s browser. The issue is tied to the legacy node-server behavior of the admin panel; the funct...

OpenZiti Console 代码问题漏洞

OpenZiti Console is an OpenZiti open source web interface for the management of an OpenZiti network. A code issue vulnerability exists in OpenZiti Console versions prior to 3.7.1 that stems from unauthenticated access to an endpoint and could lead to server-side request forgery...

OpenZiti Console 跨站脚本漏洞

OpenZiti Console is an OpenZiti open source web interface for the management of an OpenZiti network. A cross-site scripting vulnerability exists in OpenZiti Console versions prior to 3.7.1, which stems from unauthenticated access to the /api/upload endpoint and could lead to a stored cross-site...