CVE-2026-97179

Name of the Vulnerable Software and Affected Versions O2OA versions prior to 9.5.4 O2OA versions prior to 10.0.3

Description An issue exists in the Cipher Connection Handler component within the list() function of the o2server/x base core project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java file. Remote manipulation of the fileUrl argument can lead to information disclosure.

Recommendations As a temporary workaround, restrict access to the list() function in the CipherConnectionAction.java file or avoid using the fileUrl argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.