CVE-2025-59954 CRITICAL

CVE-2025-59954: Knowage Contains a Remote Code Execution Vulnerability

Vendor Knowagelabs
Product Knowage-Server
Weakness CWE-94 · Code injection
Published September 29, 2025
Last update September 30, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

What the vulnerability does

01Description

Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.

Key dates

02Disclosure timeline

September 29, 2025 CVE published
September 30, 2025 Record updated