CVE-2018-25421: Openstamanager Open Sta Manager

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/backup/actions.php with op=getfile and traverse directories using ../ sequences to access sensitive system files.

Affected products

• Openstamanager Open Sta Manager: version 2.3 only

Published 2026-05-30. Last modified 2026-07-22.