CVE-2025-28386

The vulnerability (CWE-94 — improper control of code generation) consists of the ability to upload a crafted file with a .txt extension to the plugin management component. This file contains malicious code that is subsequently interpreted or executed by the server-side application. The lack of proper validation of the uploaded file content allows bypassing security mechanisms and executing arbitrary instructions in the context of the application process.

An attacker can remotely execute arbitrary code on the server without requiring any privileges, which may lead to complete system takeover, data leakage, and violation of the platform's integrity and availability.

Patches available from the vendor should be applied according to the references. Additionally, it is recommended to restrict access to the Plugin Management component exclusively to trusted and authenticated users, and to monitor attempts to upload files to this module.

OpenC3 COSMOS v6.0.0