CVE-2025-28382
Published: 13 June 2025
Summary
CVE-2025-28382 is a high-severity Path Traversal (CWE-22) vulnerability in Openc3 Cosmos. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-28382 is a directory traversal vulnerability, tracked as CWE-22, that affects the openc3-api/tables endpoint in OpenC3 COSMOS versions prior to 6.1.0. The flaw carries a CVSS 3.1 score of 7.5 and permits unauthenticated network attackers to access files outside intended directories, resulting in high confidentiality impact without affecting integrity or availability.
An attacker can send crafted requests to the tables endpoint to traverse the filesystem and retrieve sensitive files. Because the attack requires no credentials or user interaction and can be performed remotely, it enables straightforward information disclosure against any exposed COSMOS instance running an affected release.
The referenced commit, pull request, and v6.1.0 release tag indicate that the vendor addressed the issue by patching the endpoint; operators should upgrade to OpenC3 COSMOS 6.1.0 or later. A separate security assessment of the framework is also referenced among the advisories.
The EPSS score remains flat at 0.0206 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18282
Vulnerability details
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.