CVE-2025-12922 | OpenClinica Community Edition up to 3.12.2/3.13 CRF Data Import ImportCRFData?action=confirm xml_file path traversal

A vulnerability identified as critical has been detected in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal.

This vulnerability is identified as CVE-2025-12922. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.