CVE-2025-27590: Oxidized Web Project Oxidized Web

Critical severity, CVSS 9.8. EPSS: 27.6% chance of exploitation in the next 30 days.

In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.

Affected products

• Oxidized Web Project Oxidized Web: before 0.15.0 (fixed in 0.15.0)

Published 2025-03-03. Last modified 2026-06-17.