Cyber Resilience

CVE-2025-28382

HighPublic PoC

Published: 13 June 2025

Published
13 June 2025
Modified
27 October 2025
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0206 84.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28382 is a high-severity Path Traversal (CWE-22) vulnerability in Openc3 Cosmos. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2025-28382 is a directory traversal vulnerability, tracked as CWE-22, that affects the openc3-api/tables endpoint in OpenC3 COSMOS versions prior to 6.1.0. The flaw carries a CVSS 3.1 score of 7.5 and permits unauthenticated network attackers to access files outside intended directories, resulting in high confidentiality impact without affecting integrity or availability.

An attacker can send crafted requests to the tables endpoint to traverse the filesystem and retrieve sensitive files. Because the attack requires no credentials or user interaction and can be performed remotely, it enables straightforward information disclosure against any exposed COSMOS instance running an affected release.

The referenced commit, pull request, and v6.1.0 release tag indicate that the vendor addressed the issue by patching the endpoint; operators should upgrade to OpenC3 COSMOS 6.1.0 or later. A separate security assessment of the framework is also referenced among the advisories.

The EPSS score remains flat at 0.0206 with no material increase after disclosure.

EU & UK References

Vulnerability details

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

openc3
cosmos
6.0.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References