CVE-2025-6775 is a medium severity (CVSS 6.3) command injection in openvpn-cms-flask up to 1.2.7. The Username value in the create user endpoint reaches a command. A public exploit is noted in the record. Upgrade to version 1.2.8 to fix it.
What's affected
xiaoyunjie openvpn-cms-flask versions up to and including 1.2.7. The record says upgrading to 1.2.8 addresses the issue and names the patch commit e23559b98c8ea2957f09978c29f4e512ba789eb6. The affected code is the create_user function in app/api/v1/openvpn.py, in the user creation endpoint.
Severity wording differs inside the record. The description calls the issue critical, which is VulDB's own label, while the CVSS score of 6.3 maps to medium. This post follows the score. The record says an exploit has been disclosed publicly, but does not mark the CVE as known exploited by CISA.
How to check if you're exposed
The project is a Python Flask web application for managing OpenVPN users. Check which version you deployed:
git -C /path/to/openvpn-cms-flask describe --tags
pip freeze | grep -i openvpn
If you deployed from a clone, compare your checkout with the v1.2.8 tag and confirm the patch commit is present:
git -C /path/to/openvpn-cms-flask branch --contains e23559b
Also review where the endpoint is reachable. A VPN management interface that is open to the internet is a much larger risk than one limited to an admin network.
What to do now
- Find every deployment of openvpn-cms-flask.
- Upgrade to 1.2.8 or later, or apply commit e23559b.
- Restrict the web interface to an admin network or behind a VPN.
- Review the list of OpenVPN users for accounts you did not create.
- Review the code you own for any place a username is passed to a shell command, and replace it with an argument list that avoids the shell.
Why it matters
The weakness is CWE-77 together with CWE-74: input used to build a command without neutralizing special characters. Account creation tools often call system utilities to generate certificates and config files, and the account name is the most obvious value to forward to them.
The fix pattern is well known. Validate usernames against a strict pattern, and call programs with an argument list instead of a shell string. The same project had a second flaw fixed in the same release, CVE-2025-6776. Small open source admin tools like this often receive little review, so treat their exposure as you would a production system.
Quick check
Is the critical wording in the description correct?
The description repeats VulDB wording. The CVSS score in the record is 6.3, which is medium.
Does the same release fix the second CVE?
The record for CVE-2025-6776 also names 1.2.8 and the same patch commit.
Sources
- Safeguard Gold page for CVE-2025-6775
- openvpn-cms-flask v1.2.8 release (listed in the record; fetched)
- Patch commit e23559b (listed in the record)
Last reviewed: 18 October 2026.
