The Files application in Open OnDemand is vulnerable to an input validation flaw when navigating to a directory. According to the advisory, malicious directory names are not neutralized properly, leaving the application susceptible to processing of untrusted input. This weakness, classified as CWE‑74, could enable an attacker to influence the file system handling logic, potentially exposing sensitive resources or causing unintended behavior.

OSC: Open OnDemand is affected. Versions prior to 4.0.9 for the 4.x series and prior to 4.1.3 for the 4.1.x series remain vulnerable. Upgrading to 4.0.9 or 4.1.3 applies the fix; any lower version should be considered susceptible.

The CVSS score of 6.3 signals a moderate severity. The EPSS score of less than 1 % indicates that, at the time of analysis, the likelihood of exploitation is very low, and the vulnerability is currently not listed in the CISA KEV catalog. The flaw can be triggered via the web interface when a user submits a path in the Files application, but no specific authentication requirements are disclosed. In the absence of known exploits, the immediate risk remains moderate; however, organizations should prioritize remediation to eliminate the potential attack surface.