← Vulnerability feed

Vulnerability record · CVE-2025-30343 · published 21 March 2025

CVE-2025-30343: Openslides path traversal vulnerability

Openslides · Openslides

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.

6.5 CVSS 3.1 Medium EPSS 0.47% · top 61.6% CWE-24 · CWE-24CWE-22 · Path traversal
6.5CVSS 3.1 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides ExploitThird Party Advisory

Track CVE-2025-30343 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-25519Openslides improper access control vulnerabilityOpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to v…EPSS 0.68%8.9CVE-2020-26280Openslides cross-site scripting vulnerabilityOpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides…EPSS 1.4%7.5CVE-2024-22892Openslides inadequate encryption strength vulnerabilityOpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.EPSS 0.25%7.5CVE-2024-22893Openslides improper privilege management vulnerabilityOpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain…EPSS 0.36%6.1CVE-2025-30342Openslides cross-site scripting vulnerabilityAn XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown tha…EPSS 0.26%4.1CVE-2025-30345Openslides cross-site scripting vulnerabilityAn issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of…EPSS 0.28%3.7CVE-2025-30344Openslides observable discrepancy vulnerabilityAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on…EPSS 0.32%8.6CVE-2026-20349Cisco ASA and FTD SSL VPN HTTP request handling denial of serviceCisco Secure Firewall ASA and FTD software fail to properly check errors when processing HTTP requests in the Remote Access SSL VPN service. An unaut…KEVEPSS 1.0%analysed

Source: NIST National Vulnerability Database (record CVE-2025-30343), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.