CVE-2025-12922: OpenClinica Path Traversal Vulnerability

CVE-2025-12922 Overview

CVE-2025-12922 is a path traversal vulnerability [CWE-22] in OpenClinica Community Edition versions up to 3.12.2 and 3.13. The flaw resides in the /ImportCRFData?action=confirm endpoint of the Case Report Form (CRF) Data Import component. An authenticated remote attacker can manipulate the xml_file parameter to traverse directories outside the intended upload path. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The issue carries a CVSS 4.0 score of 2.1, reflecting limited confidentiality, integrity, and availability impact with required low-level privileges.

Critical Impact
Authenticated attackers can read or reference files outside the intended directory by manipulating the xml_file argument, potentially exposing sensitive clinical trial data managed by OpenClinica.

Affected Products

OpenClinica Community Edition 3.12.2
OpenClinica Community Edition 3.13
CRF Data Import component (/ImportCRFData?action=confirm)

Discovery Timeline

2025-11-10 - CVE-2025-12922 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-12922

Vulnerability Analysis

The vulnerability exists in the CRF Data Import workflow exposed at /ImportCRFData?action=confirm. OpenClinica accepts an xml_file argument that references a previously uploaded XML file for confirmation and processing. The application fails to canonicalize or restrict this path, allowing an attacker to supply traversal sequences such as ../ to point at arbitrary files on the server filesystem. Because OpenClinica handles regulated clinical trial data, unauthorized file references can expose study artifacts, configuration files, or other tenant data. The EPSS score of 0.083% places near-term exploitation probability in the 24th percentile, but a public proof of concept has been released on GitHub.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The CRF Data Import handler trusts the user-supplied xml_file value when constructing the filesystem path used during confirmation. Without normalization checks against a whitelisted base directory, relative path segments are honored and resolved by the underlying file API.

Attack Vector

An authenticated user with low privileges sends a crafted HTTP request to /ImportCRFData?action=confirm with an xml_file parameter containing traversal characters. The request can be issued remotely over the network without user interaction. Technical details and abridged raw HTTP requests are documented in the GitHub security findings writeup and the VulDB entry #331642.

No verified exploit code is reproduced here. Refer to the raw request examples on GitHub for the published proof of concept.

Detection Methods for CVE-2025-12922

Indicators of Compromise

HTTP requests to /ImportCRFData?action=confirm containing ../, ..\, URL-encoded variants (%2e%2e%2f), or absolute paths in the xml_file parameter.
Web server access logs showing the CRF Data Import endpoint being called by accounts that do not normally perform data imports.
Application logs referencing file reads outside the OpenClinica upload directory during CRF import operations.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the xml_file parameter for path traversal sequences and blocks or alerts on matches.
Correlate authenticated session activity with anomalous file access patterns on the OpenClinica application server filesystem.
Hunt for repeated 4xx/5xx responses from /ImportCRFData that may indicate enumeration of the traversal path depth.

Monitoring Recommendations

Forward OpenClinica application and web server logs to a centralized logging or SIEM platform for retention and search.
Baseline normal CRF import volumes per user account and alert on deviations.
Monitor filesystem audit logs for reads or references to sensitive files (e.g., /etc/passwd, application configuration files) from the OpenClinica service account.

How to Mitigate CVE-2025-12922

Immediate Actions Required

Restrict network access to OpenClinica 3.12.2 and 3.13 Community Edition instances to trusted networks or VPN users only.
Limit the set of accounts permitted to perform CRF data imports to a minimal, audited group.
Enable WAF or reverse proxy filtering for path traversal patterns targeting /ImportCRFData.
Review historical web server logs for prior exploitation attempts against the xml_file parameter.

Patch Information

No vendor patch is currently referenced in the CVE record. The vendor was contacted before public disclosure but did not respond. Organizations should monitor the OpenClinica project repositories for fixes and consider migrating to a supported edition or alternative platform if no remediation is forthcoming.

Workarounds

Place OpenClinica behind a reverse proxy that strips or rejects requests containing traversal sequences in query parameters.
Enforce strict filesystem permissions so the OpenClinica service account can only read and write within its designated data directories.
Disable or block the /ImportCRFData endpoint at the proxy layer when CRF imports are not actively required.
Apply SELinux or AppArmor profiles to constrain file access by the OpenClinica process.

bash

# Example nginx snippet to block traversal patterns on the CRF import endpoint
location /ImportCRFData {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://openclinica_backend;
}