CVE-2025-27232: Frontend arbitrary file read in oauth.authorize action
Published Dec 1, 2025
·Updated
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
Affected Software
2 affected components
Zabbix Zabbix
Zabbix Frontend>=7.4.0<7.4.3
Remediation
Information
Update the affected components to their respective fixed versions.
Event History
Dec 1, 2025
CVE Published
via MITRE·12:55 PM
Data Sourced
via MITRE·12:55 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-27232?
CVE-2025-27232 is classified as a critical vulnerability due to potential confidentiality loss.
2
How do I fix CVE-2025-27232?
To remediate CVE-2025-27232, ensure that the Zabbix application is updated to the latest patched version provided by the vendor.
3
Who is affected by CVE-2025-27232?
CVE-2025-27232 affects authenticated users with Super Admin privileges in Zabbix.
4
What are the risks associated with CVE-2025-27232?
The risks include unauthorized access to sensitive files on the webserver, leading to potential data breaches.
5
Can CVE-2025-27232 be exploited remotely?
Yes, CVE-2025-27232 can be exploited remotely by an authenticated Super Admin.