CVE-2025-62724
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a Time of Check to Time of Use (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. Files accessed are still protected by UNIX permissions.
Risk Assessment
A user may bypass the file allowlist and access files outside OOD_ALLOWLIST, though UNIX permissions still apply. The risk affects sites using file browser allowlists in OOD.
Recommendation
Update Open OnDemand to version 4.0.8 or 3.1.16 (or later). Verify UNIX permissions on files exposed through the portal.
Other vulnerabilities in Open OnDemand
See all- CVE-2026-44371Medium
Open OnDemand (an HPC portal) before versions 4.0.11, 4.1.5, and 4.2.2 allows specially crafted filenames to execute JavaScript in the file browser. Fixed in 4.0.11, 4.1.5, and 4.2.2.
- CVE-2025-64185Medium
Open OnDemand, an HPC portal, in versions prior to 4.0.8 and 3.1.16 creates world-writable locations in the GEM_PATH, potentially allowing unauthorized modifications.
Original NVD description (English source)
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS