CVE-2025-30343

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.

• CWE-24
• CWE-22

• https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlidesExploit, Third Party Advisory

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30329Animate versions 24.0.8, 23.0.11 and earlier are affected by…5.5
• CVE-2025-3033After selecting a malicious Windows `.url` shortcut from the…7.7
• CVE-2025-30330Illustrator versions 29.3, 28.7.5 and earlier are affected b…7.8
• CVE-2025-30334In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before erra…7.1
• CVE-2025-3034Memory safety bugs present in Firefox 136 and Thunderbird 13…8.1
• CVE-2025-30342An XSS issue was discovered in OpenSlides before 4.2.5. When…6.1
• CVE-2025-30344An issue was discovered in OpenSlides before 4.2.5. During l…3.7
• CVE-2025-30345An issue was discovered in OpenSlides before 4.2.5. When cre…4.1
• CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0…4.8
• CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers …7.5
• CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorith…5.3
• CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Fra…7.2