CVE-2025-27232

MediumCVSS 4.9/10Last modified Sep 26, 2026

Description

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-272335.7Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments int CVE-2025-272347.3Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments int CVE-2025-272366.5A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This CVE-2025-272377.3In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing mali CVE-2025-272383.5Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to the CVE-2025-272407.2A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.CVE-2025-272415.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.CVE-2025-272425.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.CVE-2025-272434.4Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS ma CVE-2025-272445.9AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive CVE-2025-272466.7Incorrect default permissions for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may a CVE-2025-272475.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.