Quick answers
- Is CVE-2025-13872 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-13872 being exploited in the wild.
- How severe is CVE-2025-13872?
- Critical severity, with a CVSS score of 9.1, published 2 December 2025.
- Which products and versions are affected?
- Objectplanet Opinio 7.26 rev12562 and earlier.
- Is there a fix for CVE-2025-13872?
- A patch was published on 2025-07-31: Fixed in Opinio 7.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-13872 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-13872?
- Check whether you run Objectplanet Opinio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a blind server-side request forgery (SSRF) vulnerability in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562. The vulnerability allows an attacker to craft malicious import requests that cause the server to perform HTTP GET requests to arbitrary destinations without proper validation or sanitization. The attack does not require authentication or user interaction beyond uploading a crafted survey import file. An attacker can exploit this to access internal network resources, retrieve sensitive data from internal systems, or launch attacks against third-party services from the server's perspective. The vulnerability has been patched in Opinio 7.27 (released July 31, 2025) and subsequent versions.
Affected products
- ObjectPlanet Opinio 7.26 rev12562 and earlier
Timeline
- 2025-12-02: disclosed
- 2025-07-31: patched: Fixed in Opinio 7.27