CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action
An authenticated Zabbix Super Admin can read arbitrary files from the webserver via the oauth.authorize action, causing confidentiality loss.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27232?
CVE-2025-27232 is a medium-severity server-side request forgery vulnerability in Zabbix, published on 1 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
Weakness: CWE-918
Which versions are affected by CVE-2025-27232?
It affects 1 product.
Products include Zabbix Frontend.
How do I fix CVE-2025-27232?
No fix has been published for CVE-2025-27232 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-27232 being exploited?
There is no known exploitation of CVE-2025-27232 in the wild and no public exploit code.
Other vulnerabilities in Zabbix
- CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2023-29457 Insufficient validation of Action form input fields
- CVE-2025-49643 Frontend DoS vulnerability due to asymmetric resource consumption
- CVE-2023-29456 Inefficient URL schema validation
- CVE-2023-29454 Persistent XSS in the user form
Sources
Also known as GHSA-q44w-9xjg-492g, UBUNTU-CVE-2025-27232.