CVE-2025-10777

A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to address this issue. The affected component should be upgraded. R7-Office is a fork of OpenOffice and at the moment it remains unclear if OpenOffice is affected as well. The OpenOffice team was not able to reproduce the issue in their codebase. The vendor replied: "We confirm that this vulnerability has been verified and patched in release 2025.3.1.923. During our security testing, it was not possible to exploit the issue - the server consistently returns proper error responses to the provided scenarios."

• CWE-22

• https://vuldb.com/?ctiid.325133
• https://vuldb.com/?id.325133
• https://vuldb.com/?submit.638446

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10771A vulnerability was determined in jeecgboot JimuReport up to…9.8
• CVE-2025-10772A vulnerability was identified in huggingface LeRobot up to …6.3
• CVE-2025-10773A security flaw has been discovered in B-Link BL-AC2100 up t…8.8
• CVE-2025-10774A weakness has been identified in Ruijie 6000-E10 up to 2.4.…4.7
• CVE-2025-10775A security vulnerability has been detected in Wavlink WL-NU5…7.2
• CVE-2025-10776A vulnerability was detected in LionCoders SalePro POS up to…3.7
• CVE-2025-10778A vulnerability has been found in Smartstore up to 6.2.0. Th…3.1
• CVE-2025-10779A vulnerability was found in D-Link DCS-935L up to 1.13.01. …9.8
• CVE-2025-1078A vulnerability has been found in AppHouseKitchen AlDente Ch…5.3
• CVE-2025-10780A vulnerability was determined in CodeAstro Simple Pharmacy …8.8
• CVE-2025-10781A vulnerability was identified in Campcodes Online Learning …9.8
• CVE-2025-10782A security flaw has been discovered in Campcodes Online Lear…9.8