OpenSTAManager has an OS Command Injection in P7M File Processing
Date: 2026-02
Affected: composer/devcode-it/openstamanager
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-69212
CWE: CWE-78

## Summary A critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server. ## Vulnerable Code **File:** `src/Util/XML.php:100` ```php public static function decodeP7M($file) { $directory = pathinfo($file, PATHINFO_DIRNAME); $content = file_get_contents($file); $output_file = $directory.'/'.basename($file, '.p7m'); try { if (function_exists('exec')) { // VULNERABLE - No input sanitization! exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', $output, $cmd); ``` **The Problem:** - The `$file` parameter is passed directly into `exec()` without sanitization - Although wrapped in double quotes, an attacker can escape them - The filename comes from uploaded ZIP archives (user-controlled) ## Attack Vector ### Entry Points: 1. **plugins/importFE_ZIP/actions.php:126** (when automatic import is enabled) ```php foreach ($files_xml as $xml) { if (string_ends_with($xml, '.p7m')) { $file = XML::decodeP7M($directory.'/'.$xml); // $xml from ZIP! ``` 2. **plugins/importFE/src/FatturaElettronica.php:56** (constructor) ```php if (string_ends_with($name, '.p7m')) { $file = XML::decodeP7M($this->file); // $name from user input! ``` ### Attack Flow: 1. Attacker creates Z


Mitigations:

Architectural layers (MAESTRO):