CVE-2025-12250: OpenWGA Path Traversal Vulnerability

CVE-2025-12250 Overview

CVE-2025-12250 is a path traversal vulnerability [CWE-22] in OpenWGA 7.11.12 Build 737. The flaw resides in the WGA.File function of the TMLScript API component. Attackers with authenticated high-privilege access can manipulate file path input to access files outside the intended directory. The issue is exploitable remotely over the network and a public exploit has been published. The vendor was contacted before disclosure but did not respond.

Critical Impact
Remote authenticated attackers can read or reference files outside intended directories through the WGA.File TMLScript API, exposing configuration data and application internals.

Affected Products

OpenWGA 7.11.12 Build 737
TMLScript API component
WGA.File function

Discovery Timeline

2025-10-27 - CVE-2025-12250 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12250

Vulnerability Analysis

The vulnerability affects the WGA.File function within the TMLScript API of OpenWGA 7.11.12 Build 737. TMLScript is the server-side scripting engine used by OpenWGA to build content applications. The WGA.File API is designed to reference server-side files for application logic. Insufficient validation of user-supplied path components allows an authenticated actor to traverse the filesystem using sequences such as ../ and reach files outside the application's intended scope. Because the attack occurs over the network and requires only high-privilege authentication, an attacker with valid backend credentials can weaponize legitimate scripting features to access sensitive resources on the host.

Root Cause

The root cause is missing or inadequate canonicalization of file path inputs passed into WGA.File. The function accepts caller-controlled path strings without rejecting parent-directory traversal sequences or restricting resolution to a defined base directory. This maps directly to CWE-22 Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the OpenWGA application and high-privilege authenticated context capable of executing TMLScript. The attacker crafts a TMLScript expression that invokes WGA.File with a relative traversal path, causing the runtime to resolve a file location outside the intended content directory. User interaction is not required. Public exploitation details are available in the GitHub security_findings repository and the VulDB entry.

No verified proof-of-concept code is reproduced here. Refer to the linked references for technical exploitation details.

Detection Methods for CVE-2025-12250

Indicators of Compromise

TMLScript source or stored templates that contain WGA.File calls referencing path segments with ..\ or ../ sequences.
Access log entries showing authenticated backend users invoking template endpoints with unexpected filesystem paths.
Unexpected reads of OpenWGA configuration files, certificate stores, or operating system files by the OpenWGA service account.

Detection Strategies

Audit stored TMLScript templates and design documents for WGA.File invocations that accept dynamic input without sanitization.
Enable application-level logging for TMLScript API calls and alert on file paths containing traversal sequences.
Correlate authentication events for privileged OpenWGA accounts with file access events on the underlying host to spot anomalous read patterns.

Monitoring Recommendations

Monitor the OpenWGA service account for reads outside its designated content roots at the operating system level.
Alert on outbound HTTP requests to TMLScript endpoints that include encoded traversal payloads such as %2e%2e%2f.
Track privileged administrative logins to OpenWGA and flag sessions that modify or upload new TMLScript templates.

How to Mitigate CVE-2025-12250

Immediate Actions Required

Restrict access to OpenWGA administrative and content-authoring interfaces to trusted networks only, since exploitation requires high-privilege authentication.
Rotate credentials for all OpenWGA administrator and designer accounts and enforce multi-factor authentication where supported.
Review existing TMLScript templates and remove or refactor any that pass untrusted input into WGA.File.
Run the OpenWGA process under a least-privilege operating system account with filesystem access limited to required directories.

Patch Information

No vendor patch or advisory is available. The reporter indicated that the vendor was contacted before disclosure but did not respond. Organizations running OpenWGA 7.11.12 Build 737 should treat this as an unpatched issue and rely on compensating controls until a fixed build is released. Track updates through the VulDB CTI entry.

Workarounds

Deploy a web application firewall rule that blocks traversal sequences such as ../, ..\, and their URL-encoded variants on TMLScript endpoints.
Use operating system controls such as mandatory access control profiles or filesystem ACLs to confine the OpenWGA process to its content directory.
Disable or remove TMLScript features that call WGA.File if they are not required by the deployed applications.
Place OpenWGA behind an authenticated reverse proxy that restricts administrative endpoints to specific source addresses.

bash

# Example WAF pattern for blocking traversal on OpenWGA endpoints
# Reject requests to TMLScript paths containing traversal sequences
SecRule REQUEST_URI "@rx /tmlscript/" \
    "chain,deny,status:403,id:1012250,msg:'CVE-2025-12250 OpenWGA path traversal attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)" "t:lowercase"