What’s Vulnerable › Vulnerabilities
CVE-2025-64185: Open OnDemand RPM packages create world writable locations
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-20 · updated 2026-10-18
- Weakness: CWE-277
Description
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
Affected products
- OSC ondemand: before 4.0.8; before 3.1.16
References
Get alerted when CVE-2025-64185 or the next vulnerability affects your stack