CVE-2025-6776 is a high severity (CVSS 7.3) path traversal in openvpn-cms-flask up to 1.2.7. The image argument of the file upload function can reach outside the intended folder. A public exploit is noted in the record. Upgrade to version 1.2.8.
What's affected
xiaoyunjie openvpn-cms-flask versions up to and including 1.2.7. The record says upgrading to 1.2.8 addresses the issue and names the patch commit e23559b98c8ea2957f09978c29f4e512ba789eb6. The code involved is the Upload function in app/plugins/oss/app/controller.py, in the file upload component.
The record states that the attack can be started remotely and that an exploit has been disclosed publicly. It does not list the CVE as known exploited by CISA. The record's description also labels the issue critical while the CVSS score of 7.3 is high; this post uses the score.
How to check if you're exposed
Confirm which version of the project you run and whether the patch commit is in your checkout:
git -C /path/to/openvpn-cms-flask describe --tags
git -C /path/to/openvpn-cms-flask branch --contains e23559b
Then look at the upload folder. Files that appear outside it, or files with unexpected names or extensions, are worth a look. Review web server access logs for upload requests with unusual file names.
grep -i "upload" /var/log/nginx/access.log | tail -50
What to do now
- Locate all openvpn-cms-flask deployments, including test copies.
- Upgrade to 1.2.8 or later, or apply commit e23559b.
- Limit access to the web interface and require authentication in front of it.
- Check the file system for files that should not be there, and review file permissions for the app account.
- In your own code, resolve user supplied file names and confirm the result stays inside the intended directory.
Why it matters
The weakness is CWE-22, path traversal. A file name supplied by a user is joined to a directory path without making sure the final location stays inside that directory. Sequences that move up a directory level can then reach other parts of the file system.
Depending on where the application writes, this can overwrite files or place content in locations the operator did not intend. The usual defence is to generate your own file names, resolve the final path and check it against the allowed folder before writing. The sibling flaw in the same release is CVE-2025-6775.
If you cannot upgrade at once, the least you can do is shrink the audience. Keep the interface off the public internet, require a VPN or an allow list, and run the application under an account that can write only to its own upload folder. Those steps do not replace the fix, but they limit what a path traversal can reach.
Quick check
Which file is involved?
The record names app/plugins/oss/app/controller.py and its Upload function.
Is it exploited in the wild?
The record says an exploit was disclosed publicly. It does not mark the CVE as a CISA KEV entry.
Sources
- Safeguard Gold page for CVE-2025-6776
- openvpn-cms-flask v1.2.8 release (listed in the record; fetched)
- Patch commit e23559b (listed in the record)
Last reviewed: 18 October 2026.
