一、 漏洞 CVE-2025-67076 基础信息

                                        # N/A

## 概述
Omnispace Agora Project 在 25.10 版本之前存在目录遍历漏洞，未经身份验证的攻击者可利用该漏洞读取系统上的文件。

## 影响版本
Omnispace Agora Project 25.10 之前的所有版本。

## 细节
攻击者可通过 `misc` 控制器的 `ExternalGetFile` 动作触发目录遍历，访问并读取服务器上的任意文件。该漏洞仅能读取带有文件扩展名的文件。

## 影响
未经认证的远程攻击者可读取系统上的敏感文件，可能导致信息泄露。
                                        

二、漏洞 CVE-2025-67076 的公开POC

三、漏洞 CVE-2025-67076 的情报信息

• 标题： Multiple vulnerabilities on Agora Project -- 🔗来源链接

  标签：

  神龙速读：

                                          ```md
  # Multiple Vulnerabilities on Agora Project
  
  ## Summary
  - **Product:** Agora Project
  - **Severity:** High
  - **CVEs:**
    - CVE-2025-67076
    - CVE-2025-67077
    - CVE-2025-67078
    - CVE-2025-67079
  - **Affected Versions:** ≤ v25.6.4
  - **Fixed Version:** v25.10
  
  ## Introduction
  Agora Project is an open-source collaboration platform for teams and organizations, providing shared file storage, notes, task management, calendars, and other collaborative features.
  
  ## Issue
  Multiple security vulnerabilities were identified in the Agora Project affecting version 25.6.4. These issues include:
  - Unauthenticated file disclosure
  - Arbitrary code execution through unsafe file handling mechanisms
  - Cross-site scripting (XSS) in the error handling logic
  
  These vulnerabilities could allow attackers to read sensitive files, upload and execute malicious payloads, and run arbitrary JavaScript in users' browsers.
  
  ## Timeline
  | Date       | Description                                 |
  |------------|---------------------------------------------|
  | 19/08/2025 | Reporting vulnerabilities                    |
  | 20/08/2025 | Response from the publisher                  |
  | 02/10/2025 | Fix has been released                        |
  | 06/01/2026 | CVE identifiers have been reserved           |
  
  ## Technical Details
  
  ### Unauthenticated File Read / CVE-2025-67076
  An unauthenticated attacker can read files from the system through the `misc` controller and the `ExternalGetFile` action. The final payload can look like this:
  
  ```
  /index.php?ctrl=misc&launchDownload=true&file=..
  ```
  This allows access to files with an extension, which may include configuration files, exported data, and other sensitive resources.
  
  ### Insufficient Blacklisting of Dangerous File Types / CVE-2025-67077
  This vulnerability can be exploited by authenticated users or guests if the option is enabled. File type and extension verification is inadequate. The blacklist-based extension check can be bypassed by uploading `.phar` files that are executed according to the web server configuration.
  
  ### Code Execution via File Upload and Imagick / CVE-2025-67079
  The Imagick library supports MSL (Magick Scripting Language), which can be exploited for code execution. Uploading a fake PDF and using Imagick's thumbnail feature leads to MSL interpretation and PHP code execution.
  
  ### Cross-Site Scripting (XSS) / CVE-2025-67078
  The `notify` parameter in the error handling logic is not properly escaped, allowing injection of JavaScript into a user's browser.
  
  ## Resources
  - [GitHub Project](#)
  - [CVE-2025-67076](#)
  - [CVE-2025-67077](#)
  - [CVE-2025-67078](#)
  - [CVE-2025-67079](#)
  ```
                                          

  

• 标题： Agora-Project : share your files, calendar, and project. - Home -- 🔗来源链接

  标签：

  神龙速读：

                                          从这个网页截图中，可以获取到以下关于漏洞的关键信息：
  
  - **页面内容和结构**: 网页展示了Omnispace服务的功能，包括文件管理、共享日历、任务共享、视频会议、新闻和投票、即时消息、论坛和调查。这些功能可能会成为攻击者关注的重点。
  
  - **登录和注册按钮**: 网页上有“Create my space”和“Connection to my space”的按钮。这些功能通常涉及到用户身份验证和会话管理，可能是SQL注入、跨站脚本(XSS)和会话劫持等漏洞的高风险区域。
  
  - **第三方库和框架**: 网页底部的源代码开放标志显示Omnispace基于Agora-Project开发，并且可以下载到GitHub。依赖于第三方库或框架可能带来已知的漏洞，攻击者可能会利用这些漏洞进行攻击。
  
  - **支付处理**: “Omnispace 50 offer”显示了支付功能，这通常需要高度安全的实现以防止金融欺诈和数据泄露。如果实现不当，可能会存在支付相关的漏洞，如价格操纵或信用卡数据泄露。
  
  - **数据安全主张**: 网页强调“Your data secured”，提到数据备份和SSL加密连接。然而，这些声明并不一定意味着实际的安全措施到位。攻击者可能会寻找实际实现中的弱点，如弱加密或配置错误。
  
  注意：该信息仅基于提供的截图，对于完整的漏洞分析，需要对网站进行全面的渗透测试和代码审查。
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2025-67076

四、漏洞 CVE-2025-67076 的评论