CVE-2025-27500

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL. This can lead to a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed within the context of the user's browser. This function is no longer necessary as the ziti-console moves from a node server application to a single page application, and has been disabled. The vulnerability is fixed in 3.7.1.

• CWE-79
• CWE-79

• https://github.com/openziti/ziti-console/security/advisories/GHSA-frxm-vm48-5qf2Third Party Advisory

Published

Mar 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27495A vulnerability has been identified in TeleControl Server Ba…9.8
• CVE-2025-27496Snowflake, a platform for using artificial intelligence in t…3.3
• CVE-2025-27497OpenDJ is an LDAPv3 compliant directory service. OpenDJ prio…8.7
• CVE-2025-27498aes-gcm is a pure Rust implementation of the AES-GCM. In dec…5.6
• CVE-2025-27499WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-2750A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-27501OpenZiti is a free and open source project focused on bringi…8.6
• CVE-2025-27505GeoServer is an open source server that allows users to shar…5.3
• CVE-2025-27506NocoDB is software for building databases as spreadsheets. T…6.1
• CVE-2025-27507The open-source identity infrastructure software Zitadel all…9
• CVE-2025-27508Emissary is a P2P based data-driven workflow engine. The Che…7.5
• CVE-2025-27509fleetdm/fleet is an open source device management, built on …9.3