CVE-2025-6776

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6776 xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6776

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-6775 xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injection

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

CVE-2025-6775

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

CVE-2025-6775 xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injection

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

PT-2025-27255

Name of the Vulnerable Software and Affected Versions: xiaoyunjie openvpn-cms-flask versions 1.2.7 and earlier Description: A critical issue has been found in the User Creation Endpoint component, specifically affecting the create user function in the /app/api/v1/openvpn.py file. The manipulation...

PT-2025-27256

Name of the Vulnerable Software and Affected Versions: xiaoyunjie openvpn-cms-flask versions 1.2.7 and earlier Description: A critical issue was found in the File Upload component, specifically affecting the Upload function of the app/plugins/oss/app/controller.py file. The manipulation of the...

openvpn-cms-flask: Path traversal vulnerability

openvpn-cms-flask is a web management system based on openvpn by xiaoyunjie individual developer in China. A path traversal vulnerability exists in openvpn-cms-flask 1.2.7 and earlier versions, which is caused by a path traversal error in the parameter image in the file...

CVE-2025-6775: Improper Neutralization of Special Elements used in a Command

A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function createuser of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible ...

CVE-2025-6776: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...