Metersphere vulnerabilities
We track 10 vulnerabilities in Metersphere products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2025.
Latest Metersphere vulnerabilities
- 7.5 High severity
metersphere: Exposure of Sensitive Information to an Unauthorized Actor
MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in ve
- 9.8 Critical severity
metersphere: Improper Neutralization of Special Elements used in an SQL Command
MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements
- 9.8 Critical severity
metersphere: Use of Hard-coded Credentials
MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can l
- 7.5 High severity
metersphere: Missing Authorization
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for
- 9.8 Critical severity
metersphere: Improper Limitation of a Pathname to a Restricted Directory
Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a n
- 8.8 High severity
metersphere: Missing Authorization
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrat
- 9.8 Critical severity
Metersphere: Improper Neutralization of Special Elements used in an OS Command
Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
- 7.5 High severity
metersphere: Missing Authorization
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files
- 8.8 High severity
metersphere: Improper Limitation of a Pathname to a Restricted Directory
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to uploa
- 8.1 High severity
metersphere: Improper Limitation of a Pathname to a Restricted Directory
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-