CVE-2026-97179: O2OA Cipher Connection CipherConnectionAction.java list information disclosure
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
O2OA deployments up to version 9.5.3 and 10.0.2 are identified as affected. The issue is in the Cipher Connection Handler's list function in CipherConnectionAction.java.
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires low privileges. No user interaction is required.
What is the impact of successful exploitation?
Manipulation of the fileUrl argument can result in information disclosure. The provided data does not identify the specific types of information that may be exposed.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.