CVE-2025-62724CWE-367CWE-61

CVE-2025-62724

Medium · published November 20, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.8th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2025-11-20T22:15Z
References (1)
https://github.com/OSC/ondemand/security/advisories/GHSA-vjpg-34px-gjrw · [email protected]
EPSS history
Timeline
  • 20 NOV 16:53Z
    Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)
    cvelistv5