Skip to content
Threat Feed
Subscribe
critical advisory

OpenSTAManager: Authenticated OS Command Injection (CVE-2025-69212)

OpenSTAManager versions 2.9.8 and earlier contain an authenticated remote code execution vulnerability (CVE-2025-69212) due to improper file path sanitization in the importFE_ZIP plugin.

CVE search metadata

CVE search record: CVE-2025-69212. Severity: high. CVSS: 8.8. EPSS: 1.94%. KEV: no. Product: OpenSTAManager (<= 2.9.8). Brief: OpenSTAManager: Authenticated OS Command Injection (CVE-2025-69212). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openstamanager-rce/

Triage facts

Revision 1
Applicability
OpenSTAManager (<= 2.9.8)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 26, 20:04 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
C3Likely

CVE-2025-69212 is a critical authenticated remote code execution vulnerability affecting OpenSTAManager versions 2.9.8 and earlier. The flaw resides in the 'plugins/importFE_ZIP/actions.php' file within the 'decodeP7M' function. An attacker with low-privileged access can leverage unsanitized file paths derived from an uploaded ZIP archive to perform OS command injection on the host server.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands with the privileges of the web server process, potentially leading to full system compromise.

Recommendation

  • Inventory all deployments of OpenSTAManager and identify versions 2.9.8 or earlier.
  • Upgrade OpenSTAManager to a patched version once released by the vendor.
  • Implement strict file upload validation and restrict access to the 'plugins/importFE_ZIP/' directory.
  • Monitor web server access logs for anomalous POST requests directed at 'plugins/importFE_ZIP/actions.php'.

Immediate actions

Inventory OpenSTAManager instances

IT Operations 24h

Deploy web server detection rules to identify exploitation attempts

Detection Engineering 24h

Threat Hunt

Identify unusual process creation spawned by the web server service account

T1203 high high confidence hunt now

Data: Process creation telemetry (e.g., Sysmon Event ID 1)

Enrichment needed

  • Fixed version (CTI) Necessary for remediation planning

Mitigations

Disable the importFE_ZIP plugin if not actively required

immediate IT Operations

CVE-2025-69212

Detection coverage 1

Detects CVE-2025-69212 Exploitation - POST to importFE_ZIP

critical

Detects potential exploitation of CVE-2025-69212 by monitoring POST requests to the vulnerable importFE_ZIP plugin actions script.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →