CVE-2025-4678: Remote Code Execution leads to Command Injection
Published Jun 10, 2025
·Updated
Improper Neutralization of Special Elements in the chromiumpath variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
Affected Software
1 affected component
Pandora ITSM
Event History
Jun 10, 2025
CVE Published
via MITRE·03:54 PM
Data Sourced
via MITRE·03:54 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-4678?
CVE-2025-4678 has a high severity due to its potential to allow OS command injection.
2
How do I fix CVE-2025-4678?
To fix CVE-2025-4678, update Pandora ITSM to version 5.0.106 or later.
3
What software is impacted by CVE-2025-4678?
CVE-2025-4678 affects Pandora ITSM version 5.0.105.
4
What type of vulnerability is CVE-2025-4678?
CVE-2025-4678 is classified as an OS command injection vulnerability.
5
What should I do if I cannot update Pandora ITSM to mitigate CVE-2025-4678?
If an update cannot be applied, implement strict input validation to sanitize the chromium_path variable.