Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 20 Nov 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability. | |
| Title | Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU) | |
| Weaknesses | CWE-367 CWE-61 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-11-20T16:53:13.495Z
Reserved: 2025-10-20T19:41:22.742Z
Link: CVE-2025-62724
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-20T17:15:51.333
Modified: 2025-11-20T17:15:51.333
Link: CVE-2025-62724
Redhat
No data.
OpenCVE Enrichment
No data.