CVE-2025-55202
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Opencast version 18.0 and versions before 17.7 have insufficient protections against path traversal attacks in the UI config module. The path is checked without checking for the file separator, potentially allowing access to files in another folder starting with the same path. This is fixed in versions 17.7 and 18.1.
Risk Assessment
An attacker could access files outside the intended directory, potentially exposing sensitive configuration data. The risk affects environments with the configuration interface exposed.
Recommendation
Update Opencast to version 17.7 or 18.1. Additionally, check for folders that start with the same path as the ui-config folder.
Other vulnerabilities in Opencast
See all- CVE-2026-77614High
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
- CVE-2025-61906Medium
Prior to Opencast 17.8 and 18.2, in some situations Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, possibly exposing internal media. The risk of actual impact is very low and requires a user with write access to an event using the editor and first clicking 'Save & Publish' before selecting 'Save'.
- CVE-2025-61788Medium
In Opencast prior to versions 17.8 and 18.2, the paella player renders user-supplied metadata (title, description, etc.) without filtering. This allows an attacker to inject malicious HTML and JavaScript that executes in the browsers of users viewing the media.
Original NVD description (English source)
Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS