CVE-2025-69212: OpenSTAManager has an OS Command Injection in P7M File Processing

February 6, 2026

A critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.

References

github.com/advisories/GHSA-25fp-8w8p-mx36
github.com/devcode-it/openstamanager
github.com/devcode-it/openstamanager/security/advisories/GHSA-25fp-8w8p-mx36
nvd.nist.gov/vuln/detail/CVE-2025-69212

Code Behaviors & Features

Detect and mitigate CVE-2025-69212 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →