CVE-2025-13871 The feature to manage resources is prone to Cross-Site Request Forgery attacks

Low 2.3 Published 2 Dec 2025 Updated 2 Dec 2025

Attackers can exploit CSRF to upload files on behalf of users and access them without authentication in ObjectPlanet Opinio.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-13871?

CVE-2025-13871 is a low-severity vulnerability in ObjectPlanet Opinio, published on 2 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-Site Request Forgery (CSRF) in the resource-management feature of

ObjectPlanet Opinio 7.26 rev12562

allows to upload files on behalf of the connected users and then access such files without authentication.

Weakness: CWE-352

Which versions are affected by CVE-2025-13871?

It affects 1 product.

Products include Objectplanet Opinio.

How do I fix CVE-2025-13871?

No fix has been published for CVE-2025-13871 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-13871 being exploited?

There is no known exploitation of CVE-2025-13871 in the wild and no public exploit code.

Sources

Also known as GHSA-wm7v-q4q9-gqfh.