openvpn-cms-flask vulnerabilities

2 known vulnerabilities in openvpn-cms-flask from Xiaoyunjie. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  openvpn-cms-flask: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-6776Jun 27, 2025Xiaoyunjie

  A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image lead

• 9.8 Critical severity

  openvpn-cms-flask: Improper Neutralization of Special Elements used in a Command

  CVE-2025-6775Jun 27, 2025XiaoyunjieEPSS 3.18%

  A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads