CVE-2025-69212
published 2026-02-06CVE-2025-69212: OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection…
PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.75%
75.1th percentile
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devcode-it | openstamanager | <= 2.9.8 | — |
| devcode-it | openstamanager | 0 – 2.9.8 | — |
| devcode | openstamanager | <= 2.9.8 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect upload of a ZIP file containing a .p7m file with a malicious filename targeting the P7M signed XML file decoding functionality in OpenSTAManager ↗
- →Monitor for OS command injection attempts originating from the P7M file decoding functionality in OpenSTAManager (devcode-it/openstamanager) versions 2.9.8 and earlier ↗
- ·Exploitation requires authentication; unauthenticated attackers cannot trigger this vulnerability directly ↗
- ·No fix was available as of the advisory date (Feb 08, 2026); affected versions are 2.9.8 and earlier of devcode-it/openstamanager ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenSTAManager has an OS Command Injection in P7M File Processing
ghsa·2026-02-06
CVE-2025-69212 [CRITICAL] CWE-78 OpenSTAManager has an OS Command Injection in P7M File Processing
OpenSTAManager has an OS Command Injection in P7M File Processing
## Summary
A critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
## Vulnerable Code
**File:** `src/Util/XML.php:100`
```php
public static function decodeP7M($file)
{
$directory = pathinfo($file, PATHINFO_DIRNAME);
$content = file_get_contents($file);
$output_file = $directory.'/'.basename($file, '.p7m');
try {
if (function_exists('exec')) {
// VULNERABLE - No input sanitization!
exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', $output, $cmd);
```
**The Problem:**
- The `$file` p
OSV
OpenSTAManager has an OS Command Injection in P7M File Processing
osv·2026-02-06
CVE-2025-69212 [CRITICAL] OpenSTAManager has an OS Command Injection in P7M File Processing
OpenSTAManager has an OS Command Injection in P7M File Processing
## Summary
A critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
## Vulnerable Code
**File:** `src/Util/XML.php:100`
```php
public static function decodeP7M($file)
{
$directory = pathinfo($file, PATHINFO_DIRNAME);
$content = file_get_contents($file);
$output_file = $directory.'/'.basename($file, '.p7m');
try {
if (function_exists('exec')) {
// VULNERABLE - No input sanitization!
exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', $output, $cmd);
```
**The Problem:**
- The `$file` p
No detection rules found.
No public exploits indexed.
2026-02-06
Published