7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-28382

CVE-2025-28382: OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-28382

CVE-2025-28382:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openc3-cosmos-tool-iframe	rubygems	= 6.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-28382 is a directory traversal flaw in the 'openc3-api/tables' endpoint of OpenC3 COSMOS 6.0.0. According to the VisionSpace security assessment, this endpoint allows unauthenticated attackers (CVSS PR:N) to perform arbitrary file reads, deletions, and copies due to improper sanitization of path parameters in the URL.

The identified vulnerable functions are the handlers within the openc3-cosmos-tool-iframe Ruby gem (part of OpenC3 COSMOS) responsible for processing GET, DELETE, and PUT requests to this endpoint. Specifically:

A function (hypothesized as OpenC3::Api::TablesController#show) handles file reads (GET requests).
A function (hypothesized as OpenC3::Api::TablesController#destroy) handles file deletions (DELETE requests).
A function (hypothesized as OpenC3::Api::TablesController#save_as) handles file copies (PUT requests with a 'save-as' directive).

These functions take path components directly from the URL and use them in file system operations. The lack of sanitization allows attackers to inject '..' sequences to navigate outside the intended directory, leading to unauthorized access. The function names and file paths are inferred based on common Ruby (specifically Rails-like) conventions for API endpoint handling and the specified affected gem, as direct source code patches were not available for analysis. The confidence is medium due to these inferences, but the vulnerable behavior of the endpoint is well-documented in the provided security assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.