Vulnerability DatabaseCVE-2025-43955
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2025-43955
Published:April 20, 2025
Updated:September 01, 2026
TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.
Related Resources (6)
https://github.com/convertigo/convertigo/releases/tag/8.3.11
https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43955.json
https://github.com/convertigo/convertigo/issues/898
https://nvd.nist.gov/vuln/detail/CVE-2025-43955
https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311
Do you need more information?
Contact Us
CVSS v4
Base Score:
1
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.2
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74
Exposed Dangerous Method or Function
CWE-749
EPSS
Base Score:
0.34