CVE-2025-27500
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Mar 3, 2025
Updated: Mar 5, 2025
CWE ID 79
Summary
CVE-2025-27500 is a vulnerability in OpenZiti, an open-source zero trust project. An unauthenticated attacker could exploit an endpoint on the admin panel, /api/upload, to upload a file containing malicious code. The file, once stored on the node and accessible via URL, could lead to a stored cross-site scripting attack. This functionality is no longer required, as OpenZiti's console transitions to a single page application, and it has been disabled in version 3.7.1.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.