OpenMediaVault local privilege escalation

Technical summary

OpenMediaVault is a Debian-based network-attached storage distribution. Its PHP system layer exposes a changePassword method in /usr/share/php/openmediavault/system/user.inc that is reachable by an authenticated local user.

The method does not validate its input strictly enough before that input reaches a privileged operation. The published record classifies the root cause as improper input validation (CWE-20) combined with improper privilege management (CWE-269); the researcher’s write-up describes the fix as adding input validation to prevent newline injection.

Impact

A local authenticated account becomes root on the appliance. On a NAS that means full control of the host and of every share and dataset it serves.

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.

Remediation

The OpenMediaVault project addressed the issue in later versions. The published record does not name a fixed version number, so none is stated here.

Disclosure timeline

1. 2025-08-22CVE record published
2. 2025-08-24Researcher’s technical write-up published

Only publicly documented dates are shown. Where a step in the process was not published, it is not listed.

References

• NVD entry
• CVE record (MITRE)

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.