Cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3adevcodeopenstamanager/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 20:04:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenSTAManager: Authenticated OS Command Injection (CVE-2025-69212)https://feed.craftedsignal.io/briefs/2026-10-openstamanager-rce/Mon, 26 Oct 2026 20:04:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openstamanager-rce/OpenSTAManager versions 2.9.8 and earlier contain an authenticated remote code execution vulnerability (CVE-2025-69212) due to improper file path sanitization in the importFE_ZIP plugin.CVE-2025-69212 is a critical authenticated remote code execution vulnerability affecting OpenSTAManager versions 2.9.8 and earlier. The flaw resides in the 'plugins/importFE_ZIP/actions.php' file within the 'decodeP7M' function. An attacker with low-privileged access can leverage unsanitized file paths derived from an uploaded ZIP archive to perform OS command injection on the host server.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands with the privileges of the web server process, potentially leading to full system compromise.

Recommendation

  • Inventory all deployments of OpenSTAManager and identify versions 2.9.8 or earlier.
  • Upgrade OpenSTAManager to a patched version once released by the vendor.
  • Implement strict file upload validation and restrict access to the 'plugins/importFE_ZIP/' directory.
  • Monitor web server access logs for anomalous POST requests directed at 'plugins/importFE_ZIP/actions.php'.
]]>criticaladvisoryweb-applicationrcevulnerability