A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function
Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal.
This vulnerability was named CVE-2025-6776. The attack can be initiated remotely. Furthermore, there is an exploit available.
It is recommended to upgrade the affected component.
