CVE-2025-61906
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Prior to Opencast 17.8 and 18.2, in some situations Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, possibly exposing internal media. The risk of actual impact is very low and requires a user with write access to an event using the editor and first clicking 'Save & Publish' before selecting 'Save'.
Risk Assessment
A user with write access may accidentally publish internal media, potentially leading to unintended information disclosure. The likelihood is very low due to the required user actions.
Recommendation
Update Opencast to version 17.8 or 18.2 (or later). Inform editor users about the risk and advise caution when saving and publishing.
Other vulnerabilities in Opencast
See all- CVE-2026-77614High
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
- CVE-2025-61788Medium
In Opencast prior to versions 17.8 and 18.2, the paella player renders user-supplied metadata (title, description, etc.) without filtering. This allows an attacker to inject malicious HTML and JavaScript that executes in the browsers of users viewing the media.
- CVE-2025-55202Medium
Opencast version 18.0 and versions before 17.7 have insufficient protections against path traversal attacks in the UI config module. The path is checked without checking for the file separator, potentially allowing access to files in another folder starting with the same path. This is fixed in versions 17.7 and 18.1.
Original NVD description (English source)
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS