OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-25fp-8w8p-mx36 | OpenSTAManager has an OS Command Injection in P7M File Processing |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 06 Feb 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server. | |
| Title | OpenSTAManager has an OS Command Injection in P7M File Processing | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-06T18:12:38.391Z
Reserved: 2025-12-29T15:00:37.380Z
Link: CVE-2025-69212
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-06T19:16:07.373
Modified: 2026-02-06T19:16:07.373
Link: CVE-2025-69212
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses