by Kastro
Paper/Archive/CVE-2025-59954

CVE-2025-59954

KnowageLabs Knowage-Server — Knowage Contains a Remote Code Execution Vulnerability

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.

Affected

ProductAffectedFixed inSource
Knowage-Server< 8.1.27–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgqrefgithub.com/KnowageLabs/Knowage-Server/commit/1bb60d42557724f7ed24c19df6c5017e169527ca