CVE-2025-27590

CVE-2025-27590 is a path traversal flaw (CWE-22) in the RANCID migration page of oxidized-web, the web interface for the Oxidized network device configuration backup tool, affecting all versions before 0.15.0. An unauthenticated attacker can send a crafted HTTP request to the migration page with attacker-controlled path input, allowing them to manipulate files on the host as the service. As a result, the attacker gains control over the Linux user account under which oxidized-web runs, which typically means the ability to read, write, or execute as that account on the Oxidized server — a system that stores network device credentials and configurations. Any deployment running oxidized-web prior to 0.15.0 is affected, including installations where the web interface is exposed to untrusted networks. Exploitation has not been observed in the wild and no public proof-of-concept is known, but the 27.6% EPSS score (98th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Upgrade oxidized-web to version 0.15.0 or later. Until then, restrict access to the oxidized-web interface to trusted management networks via firewall rules, ACLs, or an authenticating reverse proxy, since the vulnerable page requires no authentication. Also audit the Linux account running oxidized-web (e.g., check authorized_keys, cron jobs, and recent activity) for signs of compromise.