CVE-2025-27590 is a critical (CVSS 9.0) flaw in oxidized-web, the web interface for the Oxidized network configuration backup tool. Before version 0.15.0, the RANCID migration page let an unauthenticated user gain control over the Linux account that runs the service. Upgrade to 0.15.0 or later.
What's affected
The record says oxidized-web (also called Oxidized Web) before 0.15.0 is affected. Version 0.15.0 is the release tag linked in the record, and the fix commit is linked next to it.
The vector includes a changed scope (S:C) and high attack complexity (AC:H). The weakness is a path traversal, CWE-22. The record does not describe the exact request, and we do not repeat any detail beyond it.
Severity in the record: critical, CVSS 9.0, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Weakness classes: CWE-22 (Path traversal).
How to check if you're exposed
Oxidized Web is distributed as a Ruby gem, so ask RubyGems which version is installed:
gem list oxidized-web
bundle list | grep oxidized-web
If you run it in a container or a package from your distribution, check the image tag or the package version and compare it with 0.15.0.
Then check who can reach the web interface. Oxidized Web is usually an internal tool, so see whether a reverse proxy, a firewall rule or a cloud security group exposes it more widely than intended.
For your own application dependencies, the free in-browser scan at gold.safeguard.sh/scan reads a Gemfile.lock.
What to do now
- Upgrade oxidized-web to 0.15.0 or later and restart the service.
- Put the web interface behind authentication and a network allow list. Do not expose it to the internet.
- Check which Linux account runs the service, and make sure it is a dedicated low privilege user, not root.
- Review what that account can read. Oxidized holds network device credentials and configurations, so treat them as exposed if you suspect the page was reached by someone untrusted.
- Rotate device credentials stored in Oxidized if you cannot rule out access.
- Review web logs for requests to the RANCID migration page from unexpected addresses.
Why it matters
Path traversal (CWE-22) means the application builds a file path from input and fails to keep it inside the intended directory. A page that reads or writes files based on a request can then be steered somewhere it should not go. Here the record says the result is control over the account that runs the service, which is why the scope is scored as changed.
The tool matters because of what it stores. A network configuration backup service often holds device credentials and complete configurations, so an unauthenticated flaw gives access to more than the application itself. The attack complexity is high, which lowers the score from the 9.8 typical of unauthenticated bugs, but it does not make an exposed instance safe.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Which version of Oxidized Web fixes CVE-2025-27590?
0.15.0, per the record and the release tag it links.
Do I need to be logged in to be attacked?
The record says an unauthenticated user can gain control, so network access to the page is enough. Limit who can reach it.
Sources
Last reviewed: 19 October 2026.
