What is the CVSS score of CVE-2025-69212?

CVE-2025-69212 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openstamanager are affected by CVE-2025-69212?

OpenSTAManager versions 2.9.8 and earlier contain a critical OS command injection vulnerability in P7M file processing that could allow attackers to execute arbitrary system commands with application…

Is there a public PoC exploit available for CVE-2025-69212?

Yes, a public proof-of-concept exploit is available for CVE-2025-69212. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-69212?

Within 24 hours: Identify all systems running OpenSTAManager 2.9.8 or earlier and restrict P7M file upload/processing capabilities. Within 7 days: Implement network segmentation to isolate affected systems, disable P7M decoding if not business-critical, and deploy WAF rules blocking suspicious P7M submissions. Within 30 days: Plan emergency migration to alternative solutions or establish continuous monitoring for exploitation attempts while awaiting vendor patch availability.

Openstamanager CVE-2025-69212

HIGH

OS Command Injection (CWE-78)

2026-02-06 security-advisories@github.com

GHSA-25fp-8w8p-mx36

Command Injection Openstamanager Devcode

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 21:54 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 19:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.

AnalysisAI

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Openstamanager. OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.