CVE-2025-13871

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Dec 2, 2025

CISA due date

—

The record

Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

Affected packages

Ecosystem	Package	Introduced	Fixed