Executive brief
OpenMediaVault, a popular open-source Network Attached Storage (NAS) solution, contains a security flaw in how it handles password changes. An attacker with a standard user account can use a specially crafted password to trick the system into changing the administrative (root) password. This allows a low-privileged user to take full control of the storage device, potentially leading to the theft or deletion of all stored data and complete system compromise.
Technical details
A newline injection vulnerability exists in the `changePassword()` method within `/usr/share/php/openmediavault/system/user.inc` in OpenMediaVault 7.4.17. The application fails to sanitize the `$password` input before writing it to a temporary file in the format `username:password`. This file is subsequently passed to the Linux `chpasswd` utility, which processes input line-by-line. By injecting a newline character (e.g., `password\nroot:newrootpass`), an authenticated local attacker can append a second instruction to the `chpasswd` command. Because the process executes with elevated privileges, the attacker can successfully reset the root password and achieve full system compromise.
Affected products
- OpenMediaVault Project OpenMediaVault 7.4.17
Timeline
- 2025-08-19: other: Vulnerability discovered and documented by researcher
- 2025-08-22: disclosed: Initial CVE publication
- 2025-08-24: advisory: Detailed technical blog post published by researcher