An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /apps/?app=../ URIs.
Why it matters now
EPSS 0.03234 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:observium:observium:20.8.10631:*:*:*:community:*:*:* | 20.8.10631 | Vulnerable | Observium |
| cpe:2.3:a:observium:observium:20.8.10631:*:*:*:enterprise:*:*:* | 20.8.10631 | Vulnerable | Observium |
| cpe:2.3:a:observium:observium:20.8.10631:*:*:*:professional:*:*:* | 20.8.10631 | Vulnerable | Observium |
- cpe:2.3:a:observium:observium:20.8.10631:*:*:*:community:*:*:* Versions 20.8.10631 Vulnerable ·Observium
- cpe:2.3:a:observium:observium:20.8.10631:*:*:*:enterprise:*:*:* Versions 20.8.10631 Vulnerable ·Observium
- cpe:2.3:a:observium:observium:20.8.10631:*:*:*:professional:*:*:* Versions 20.8.10631 Vulnerable ·Observium
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25144
- 2026-10-03 Alias added: GHSA-qwmx-g9mf-cw7w
References
More Observium vulnerabilities
- TI-2024-31512 Cross-site scripting in Observium CVSS 3.1HIGH 8.7
- TI-2024-31390 Cross-site scripting in Observium CVSS 3.1HIGH 8.7
- TI-2024-30172 Cross-site scripting in Observium CVSS 3.1HIGH 8.7
- TI-2020-15389 An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. CVSS 3.1CRITICAL 9.8
- TI-2020-15374 An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. CVSS 3.1CRITICAL 9.8
- TI-2020-15391 An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. CVSS 3.1HIGH 8.8
Sources
- CVE-2020-25144 · CVE Program
- CVE-2020-25144 · NVD
- FIRST EPSS
- GHSA-qwmx-g9mf-cw7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences