CVE-2025-12922

MediumCVSS 6.3

Published: 10/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects an unknown part of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument results in path traversal. The attack can be initiated remotely, and the exploit has been made public.

Risk Assessment

The risk involves remote access to arbitrary files on the server, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

It is recommended to immediately restrict access to the CRF import functionality and apply vendor patches. Also monitor logs for unusual requests.

Other vulnerabilities in OpenClinica Community Edition

CVE-2025-12921Medium
A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects some unknown functionality of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument leads to xml injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

Original NVD description (English source)

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS