RubyGems/oxidized-web CVE-2025-27590: critical 9, EPSS 27.57%

Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

Action: Upgrade oxidized-web to 0.15.0 or later.

bundle update oxidized-web

Affected

Fixed versions

Sources

• osv: GHSA-jx6p-9c26-g373
• https://nvd.nist.gov/vuln/detail/CVE-2025-27590
• https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e
• https://github.com/ytti/oxidized-web
• https://github.com/ytti/oxidized-web/releases/tag/0.15.0

CVE-2025-27590 · published 2025-03-03T06:30:34Z · modified 2025-03-03T20:42:06.222305Z · JSON