CVE-2025-55202: 
Java vulnerability analysis and mitigation

CVE-2025-55202 is a partial path traversal vulnerability in the UI config module of Apereo Opencast, a free open-source platform for managing educational audio and video content. The flaw allows unauthenticated remote attackers to access files in directories whose names share the same prefix as the UI config directory (e.g., /etc/opencast/ui-config-hidden), but does not permit general path traversal. Affected versions are all releases before 17.7 and version 18.0; patched versions are 17.7 and 18.1. It was disclosed on August 29, 2025, with a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Github Advisory, Opencast Advisory).

The root cause is classified as CWE-23 (Relative Path Traversal): the path validation logic in UIConfigRest.java checks whether a requested file path begins with the base UI config directory path, but fails to append a file separator (File.separator) before performing the comparison. This means a directory named /etc/opencast/ui-config-hidden passes the prefix check because its canonical path starts with /etc/opencast/ui-config. The fix, applied in commit e2cc65d, appends File.separator to the basePath string before the comparison, ensuring only files strictly within the intended directory are accessible. No authentication is required to trigger the issue, and exploitation is limited to directories that happen to share the same path prefix as the configured UI config folder (Opencast Advisory, Fix Commit).

Successful exploitation results in limited unauthorized read access to files in sibling directories whose names begin with the same string as the UI config directory (e.g., /etc/opencast/ui-config-hidden), provided those files are readable by the Opencast process. There is no impact on integrity or availability, and general path traversal to unrelated directories (e.g., /etc/opencast/encoding or /etc/opencast/ directly) is not possible. The practical risk is very low given that the default Opencast deployment is unlikely to have additional directories with the ui-config prefix, making real-world data exposure extremely improbable (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.059% (0.12% per GitHub Advisory), placing it in the lower percentiles for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit scenario is highly constrained, requiring the target system to have a directory starting with the same path prefix as the UI config folder and containing files readable by Opencast (Github Advisory, Opencast Advisory).

1. Reconnaissance: Identify an Opencast instance running a version before 17.7 or exactly 18.0 that is accessible over the network.
2. Identify UI config path: Determine the configured UI config directory (default: /etc/opencast/ui-config) and check whether any sibling directories exist with names starting with ui-config (e.g., /etc/opencast/ui-config-hidden).
3. Craft malicious request: Send an unauthenticated HTTP GET request to the Opencast UI config REST endpoint, supplying a path component that resolves to a file within the sibling directory (e.g., targeting a file in /etc/opencast/ui-config-hidden/).
4. Bypass path check: Because the path validation only checks that the canonical path starts with /etc/opencast/ui-config (without a trailing separator), the request for a file in /etc/opencast/ui-config-hidden/ passes the check.
5. Access file contents: If the targeted file is readable by the Opencast process, its contents are returned in the HTTP response, potentially exposing non-public configuration data (Opencast Advisory, Fix Commit).

• Network: Unusual or unexpected HTTP GET requests to the Opencast UI config REST endpoint (/ui-config/ or equivalent) referencing paths that resolve outside the standard ui-config directory.
• Logs: Opencast access logs showing requests for files in directories with names beginning with ui-config but not matching the exact configured UI config folder; HTTP 200 responses for such requests on unpatched systems.
• File System: Presence of directories adjacent to /etc/opencast/ui-config whose names share the ui-config prefix (e.g., /etc/opencast/ui-config-hidden), which could indicate a configuration that makes exploitation feasible.

Upgrade to Opencast 17.7 or 18.1, which include the fix that appends a file separator to the base path before comparison in UIConfigRest.java. As a workaround for those unable to upgrade immediately, audit the filesystem for any directories adjacent to the UI config folder whose names begin with the same prefix (e.g., ui-config-*) and either rename or remove them, or restrict their file permissions so they are not readable by the Opencast process. The fix was merged via pull request #6979 and commit e2cc65d (Opencast Advisory, Fix PR).

The vulnerability was reported by security researcher odaysec and remediated by Opencast maintainer lkiesow. The Opencast project characterized the practical risk as extremely low given the default deployment structure, noting it is "quite unlikely for any user to have created an additional folder starting with ui-config." No significant broader media coverage or notable community debate has been observed beyond the GitHub advisory and associated pull request (Opencast Advisory, Fix PR).