CVE-2025-69212

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.

• CWE-78

• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-25fp-8w8p-mx36Exploit, Vendor Advisory

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69207Khoj is a self-hostable artificial intelligence app. Prior t…7.1
• CVE-2025-69208free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
• CVE-2025-69209ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2025-6921The huggingface/transformers library, versions prior to 4.53…7.5
• CVE-2025-69210FacturaScripts is open-source enterprise resource planning a…5.4
• CVE-2025-69211Nest is a framework for building scalable Node.js server-sid…7.4
• CVE-2025-69213OpenSTAManager is an open source management software for tec…8.8
• CVE-2025-69214OpenSTAManager is an open source management software for tec…8.8
• CVE-2025-69215OpenSTAManager is an open source management software for tec…8.8
• CVE-2025-69216OpenSTAManager is an open source management software for tec…6.5
• CVE-2025-69217coturn is a free open source implementation of TURN and STUN…7.7
• CVE-2025-69218Discourse is an open source discussion platform. In versions…6.5