CVE-2025-28384

The vulnerability consists of improper path validation (CWE-22) in the /script-api/scripts/ endpoint. An attacker can construct a crafted network request containing path traversal sequences (e.g., '../'), which allow breaking out of the allowed scripts directory. The attack does not require authentication or user interaction, making it possible to perform remotely over the network.

An attacker can gain unauthorized access to system files and modify or overwrite them, leading to violation of confidentiality and integrity of data stored on the server. Due to the nature of the platform (a framework for managing space missions), the consequences may include disclosure of sensitive operational data or sabotage of mission scripts.

OpenC3 COSMOS should be updated to version 6.1.0 or later. The fix is available in the official GitHub repository (pull request #1828, commit fc7e113). Release details available at: https://github.com/OpenC3/cosmos/releases/tag/v6.1.0

OpenC3 COSMOS in all versions prior to 6.1.0