CVE-2025-12922CWE-22path-traversal

CVE-2025-12922

Medium · published November 10, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00583 · 47.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-10T06:15Z
Affected products (2)
ProductVersionsFixed in
openclinica/openclinicaall versions—
openclinica/openclinicaall versions—
References (7)
https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md · [email protected]https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged · [email protected]https://vuldb.com/?ctiid.331642 · [email protected]https://vuldb.com/?id.331642 · [email protected]https://vuldb.com/?submit.680873 · [email protected]https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 NOV 00:02Z
    OpenClinica Community Edition CRF Data Import ImportCRFData path traversal
    cvelistv5