CVE-2025-60915: Openatlas Path Traversal Vulnerability

CVE-2025-60915 Overview

CVE-2025-60915 is a path traversal vulnerability [CWE-22] in OpenAtlas, an open-source database application developed by the Austrian Archaeological Institute for archaeological and historical research data. The flaw resides in the size query parameter handled by /views/file.py in versions prior to v8.12.0. Authenticated attackers can craft requests that escape the intended file directory and read arbitrary files on the host. Public research from Sec4You demonstrates extraction of configuration files containing sensitive secrets through this Local File Inclusion (LFI) path.

Critical Impact
Authenticated attackers can traverse the filesystem and exfiltrate configuration files, credentials, and other sensitive data accessible to the OpenAtlas service account.

Affected Products

Austrian Archaeological Institute OpenAtlas, all versions before v8.12.0
Component: /views/file.py, size query parameter
Vendor identifier: craws:openatlas

Discovery Timeline

2025-11-24 - CVE-2025-60915 published to NVD
2025-11-28 - Last updated in NVD database

Technical Details for CVE-2025-60915

Vulnerability Analysis

The vulnerability exists in the OpenAtlas file handling logic implemented in /views/file.py. The size query parameter is incorporated into a filesystem path without sufficient sanitization or canonicalization. Attackers supply directory traversal sequences such as ../ to break out of the expected file storage directory.

The issue is classified as a path traversal weakness under [CWE-22]. The attack vector is network-based and requires low privileges, meaning a low-tier authenticated user can trigger the flaw. The flaw enables high impact to confidentiality and integrity of files reachable by the application process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The size parameter is concatenated or used to resolve a file path without validating that the resulting path remains within the designated file storage boundary. No allowlist of valid size values is enforced, and no canonicalization check rejects parent-directory references.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the file view endpoint, supplying traversal sequences in the size query parameter. The server resolves the manipulated path and returns the contents of files outside the intended directory. Sec4You's published research demonstrates exfiltration of OpenAtlas configuration files, which can contain database credentials and application secrets. Refer to the Sec4You Pentest LFI Vulnerability advisory for technical details.

Detection Methods for CVE-2025-60915

Indicators of Compromise

HTTP requests to OpenAtlas file endpoints containing ../, ..%2f, or encoded traversal sequences in the size query parameter.
Web server access logs showing successful 200 responses to file requests with unusual size parameter values.
Application logs referencing reads of files outside the configured OpenAtlas uploads directory.
Unexpected egress of configuration files such as config.py, .env, or database credential files from the OpenAtlas host.

Detection Strategies

Inspect web server and reverse proxy logs for path traversal patterns in query strings to /file routes.
Deploy WAF or reverse proxy rules that flag URL-encoded and double-encoded .. sequences in the size parameter.
Correlate authenticated session activity with anomalous file read patterns at the application layer.

Monitoring Recommendations

Forward OpenAtlas application and web server logs into a centralized analytics platform for query string inspection.
Alert on file reads originating from the OpenAtlas process that target paths outside its data directory.
Track failed and successful authentication events tied to subsequent file endpoint requests to identify reconnaissance.

How to Mitigate CVE-2025-60915

Immediate Actions Required

Upgrade OpenAtlas to version v8.12.0 or later, which addresses the path traversal flaw.
Audit OpenAtlas hosts for prior access to sensitive files and rotate any credentials stored in application configuration.
Restrict network access to OpenAtlas instances so only trusted users can authenticate.
Review authenticated user accounts and remove unused or low-trust accounts that could be leveraged for exploitation.

Patch Information

The maintainers fixed CVE-2025-60915 in OpenAtlas v8.12.0. Operators should update through their standard deployment process and verify the running version after upgrade. Consult the Sec4You Pentest vulnerabilities overview for additional context on the disclosure.

Workarounds

If immediate patching is not feasible, place OpenAtlas behind a reverse proxy or WAF and block requests containing traversal sequences in the size parameter.
Run OpenAtlas under a dedicated low-privilege service account with filesystem permissions limited to its required data directories.
Move sensitive configuration files and secrets outside the OpenAtlas application directory and load them through environment variables.

bash

# Example nginx rule to block traversal patterns in the size parameter
if ($args ~* "size=[^&]*(\.\.|%2e%2e|%252e)") {
    return 403;
}