Medium severity · published Mar 30, 2025
CVE-2025-2954
mannaandpoem OpenManus File file_saver.py execute access control
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenManus · mannaandpoem
2025.3.0; 2025.3.1; 2025.3.2; 2025.3.3; 2025.3.4; 2025.3.5; +8 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2954
Broken Link
https://magnificent-dill-351.notion.site/Arbitrary-File-Writing-in-OpenManus-2025-3-13-1b9c693918ed805e8e7fd35a896d2d41
Permissions Required
https://vuldb.com/?ctiid.302007
Third Party Advisory
https://vuldb.com/?id.302007
Third Party Advisory
https://vuldb.com/?submit.521545
More from OpenManus
6.3
CVE-2025-2733
mannaandpoem OpenManus Prompt python_execute.py os command injection
