# CVE-2025-13872: ObjectPlanet Opinio blind server-side request forgery in survey import

Source: https://junglewise.ai/threats/cve-2025-13872-objectplanet-opinio-blind-server-side-request-forgery-in-survey  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13872 · Severity: critical · CVSS 9.1 · Published 2025-12-02

ObjectPlanet Opinio is a web-based survey and feedback platform used by organizations to collect and analyze customer and employee responses. A blind server-side request forgery vulnerability in the survey import feature allows an attacker to force the server to perform HTTP requests to arbitrary destinations, potentially enabling reconnaissance of internal network resources, theft of sensitive data from internal systems, or attacks against third-party services.

Technologies: [Objectplanet Opinio](https://junglewise.ai/threats/technologies/opinio). Vendors: [Objectplanet](https://junglewise.ai/threats/vendors/objectplanet).

## Quick answers

**Is CVE-2025-13872 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13872 being exploited in the wild.

**How severe is CVE-2025-13872?** Critical severity, with a CVSS score of 9.1, published 2 December 2025.

**Which products and versions are affected?** Objectplanet Opinio 7.26 rev12562 and earlier.

**Is there a fix for CVE-2025-13872?** A patch was published on 2025-07-31: Fixed in Opinio 7.27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13872 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-13872?** Check whether you run Objectplanet Opinio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a blind server-side request forgery (SSRF) vulnerability in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562. The vulnerability allows an attacker to craft malicious import requests that cause the server to perform HTTP GET requests to arbitrary destinations without proper validation or sanitization. The attack does not require authentication or user interaction beyond uploading a crafted survey import file. An attacker can exploit this to access internal network resources, retrieve sensitive data from internal systems, or launch attacks against third-party services from the server's perspective. The vulnerability has been patched in Opinio 7.27 (released July 31, 2025) and subsequent versions.

## Affected products

- ObjectPlanet Opinio 7.26 rev12562 and earlier

## Timeline

- 2025-12-02: disclosed
- 2025-07-31: patched: Fixed in Opinio 7.27

## References

- [https://www.objectplanet.com/opinio/changelog.html](https://www.objectplanet.com/opinio/changelog.html)

## Related threats

- [ObjectPlanet Opinio stored cross-site scripting in survey-import](https://junglewise.ai/threats/cve-2025-13873-objectplanet-opinio-stored-cross-site-scripting-in-survey-import)
- [Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to…](https://junglewise.ai/threats/cve-2025-13871-cross-site-request-forgery-csrf-in-the-resource-management)