CVE-2025-55202: Apereo Opencast Path Traversal Flaw

CVE-2025-55202 Overview

CVE-2025-55202 is a partial path traversal vulnerability [CWE-23] in Apereo Opencast, an open-source platform for managing educational audio and video content. The flaw exists in the UI config module, where path validation checks the base path string without accounting for the file separator. An unauthenticated network attacker can access files inside sibling folders whose names start with the same prefix as the legitimate ui-config directory. The issue affects Opencast version 18.0 and versions prior to 17.7, and has been fixed in versions 17.7 and 18.1.

Critical Impact
Unauthenticated attackers can read files from directories sharing a name prefix with the ui-config folder, resulting in limited confidentiality loss.

Affected Products

Apereo Opencast 18.0
Apereo Opencast versions before 17.7
Fixed in Opencast 17.7 and 18.1

Discovery Timeline

2025-08-29 - CVE-2025-55202 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55202

Vulnerability Analysis

The vulnerability resides in the UIConfigRest component of the user-interface-configuration module. Opencast serves UI configuration files based on organization ID, component, and filename parameters supplied in the request. To prevent directory traversal, the server resolves the requested file to its canonical path and verifies the result starts with the canonical base path.

The check uses a plain string prefix comparison without appending a trailing file separator. As a result, a base path such as /opt/opencast/ui-config/mh_default_org also matches sibling directories like /opt/opencast/ui-config/mh_default_org_backup. Attackers reach these paths by supplying crafted organization IDs, allowing retrieval of files stored in adjacent directories.

Root Cause

The root cause is improper path validation. The original implementation compared the canonical file path against a canonical base path derived from new File(uiConfigFolder, orgId).getCanonicalPath(). Because the comparison lacked a trailing separator, any directory whose name began with the base directory name satisfied the prefix check.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends HTTP requests to the UI configuration endpoint with an organization identifier that shares a prefix with a legitimate organization folder. The following patch illustrates the corrective change applied in the fix:

java

     File configFile = Paths.get(uiConfigFolder, orgId, component, filename).toFile();
 
     try {
-      final String basePath = new File(uiConfigFolder, orgId).getCanonicalPath();
+      final String basePath = new File(uiConfigFolder, orgId).getCanonicalPath() + File.separator;
       final String configFileCanPath = configFile.getCanonicalPath();
 
       // is configFile a subdirectory of basePath (additional directory traversal protection), if not stop

Source: Opencast commit e2cc65d

Detection Methods for CVE-2025-55202

Indicators of Compromise

HTTP requests to /ui/config/ endpoints containing organization identifiers with unusual suffixes or prefixes matching known org folder names.
File access log entries showing reads from directories adjacent to the configured ui-config folder.
Unexpected 200 responses for requests targeting organization IDs not provisioned in Opencast.

Detection Strategies

Review Opencast web server access logs for repeated requests to /ui/config/{orgId}/{component}/{filename} where orgId values do not match provisioned organizations.
Correlate filesystem read events on the Opencast host with HTTP requests handled by the UIConfigRest endpoint.
Deploy web application firewall rules that inspect path components in requests to the UI config service for suspicious traversal patterns.

Monitoring Recommendations

Alert on Opencast processes accessing paths outside the intended ui-config/{orgId}/ subtrees.
Track baseline request patterns to the UI configuration endpoint and flag deviations in unique organization IDs.
Monitor deployed Opencast versions across environments to identify hosts still running vulnerable releases below 17.7 or the unpatched 18.0.

How to Mitigate CVE-2025-55202

Immediate Actions Required

Upgrade Opencast to version 17.7 or 18.1, which contain the fix in UIConfigRest.java.
Inventory all Opencast deployments and identify instances running 18.0 or any release earlier than 17.7.
Restrict network exposure of the Opencast administrative interfaces to trusted networks until patching completes.

Patch Information

The fix appends File.separator to the canonical base path before performing the prefix comparison, ensuring only true subdirectories match. Review the GitHub Security Advisory GHSA-hq8m-v68g-8cf8 and Pull Request #6979 for full remediation details.

Workarounds

Audit the parent directory of ui-config and remove or rename any sibling folders that share a name prefix with legitimate organization folders.
Apply filesystem access controls that prevent the Opencast service account from reading directories adjacent to ui-config.
Front the Opencast service with a reverse proxy that normalizes and validates orgId values against an allowlist of provisioned organizations.

bash

# Example: enumerate sibling folders sharing a prefix with ui-config org directories
ls -la /opt/opencast/ui-config/
# Remove or rename any directory whose name begins with a valid org identifier prefix
mv /opt/opencast/ui-config/mh_default_org_backup /opt/opencast/backups/mh_default_org_backup