Path Traversal in Obiba Opal
CVE-2025-27101
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of the application are impacted, as this is exploitable by any user to reveal all files in the opal filesystem. This also means that low-privilege users such as DataShield users can retrieve the files of other users. Version 5.1.1 contains a patch for the issue.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (45.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Obiba Opal — versions < 5.1.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-27101?
- CVE-2025-27101 is a vulnerability in Obiba Opal, classified under Path Traversal. Published 2025-03-11.
- Is CVE-2025-27101 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.