CVE-2025-27590

Deeper analysis

In oxidized-web (also known as Oxidized Web) versions prior to 0.15.0, the RANCID migration page is vulnerable to path traversal (CWE-22), enabling an unauthenticated remote attacker to gain control over the underlying Linux user account that runs the oxidized-web process. The flaw carries a CVSS 3.1 score of 9.0 with network attack vector, high complexity, no required privileges or user interaction, and changed scope, resulting in high impact to confidentiality, integrity, and availability.

An attacker who can reach the web interface can exploit the migration page to read or write arbitrary files accessible to the oxidized-web user, thereby achieving full control of that account and any network devices or configuration data it manages. The attack requires no authentication and can be performed over the network, though the high complexity rating indicates specific conditions must be met for successful exploitation.

The referenced commit a5220a0ddc57b85cd122bffee228d3ed4901668e and the 0.15.0 release tag indicate that upgrading to oxidized-web 0.15.0 addresses the issue. The current and peak EPSS score of 0.17 shows moderate but stable exploitation probability without a documented rise after disclosure.