{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adevcodeopenstamanager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2025-69212"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenSTAManager (\u003c= 2.9.8)"],"_cs_severities":["critical"],"_cs_tags":["web-application","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Devcode"],"content_html":"\u003cp\u003eCVE-2025-69212 is a critical authenticated remote code execution vulnerability affecting OpenSTAManager versions 2.9.8 and earlier. The flaw resides in the 'plugins/importFE_ZIP/actions.php' file within the 'decodeP7M' function. An attacker with low-privileged access can leverage unsanitized file paths derived from an uploaded ZIP archive to perform OS command injection on the host server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute arbitrary OS commands with the privileges of the web server process, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployments of OpenSTAManager and identify versions 2.9.8 or earlier.\u003c/li\u003e\n\u003cli\u003eUpgrade OpenSTAManager to a patched version once released by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement strict file upload validation and restrict access to the 'plugins/importFE_ZIP/' directory.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests directed at 'plugins/importFE_ZIP/actions.php'.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T20:04:35Z","date_published":"2026-10-26T20:04:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openstamanager-rce/","summary":"OpenSTAManager versions 2.9.8 and earlier contain an authenticated remote code execution vulnerability (CVE-2025-69212) due to improper file path sanitization in the importFE_ZIP plugin.","title":"OpenSTAManager: Authenticated OS Command Injection (CVE-2025-69212)","url":"https://feed.craftedsignal.io/briefs/2026-10-openstamanager-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}