CVE-2025-13871
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows uploading files on behalf of connected users and then accessing those files without authentication.
Risk Assessment
An attacker can trick a logged-in user into uploading malicious files that then become publicly accessible. This may lead to data leakage or use of the server to distribute malicious content.
Recommendation
Update ObjectPlanet Opinio to a version containing the CSRF fix or implement anti-CSRF tokens. Consider restricting access to the resource-management feature.
Other vulnerabilities in ObjectPlanet Opinio
See all- CVE-2025-13872Critical
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
- CVE-2025-13873Medium
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS