CVE-2025-43955

State: Published
Severity: 2.2 Low
Published: Apr 20, 2025
Updated: Aug 26, 2026
Reserved: Apr 20, 2025

Description

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

Scores

CVSS	Score	Vector	Source
3.1	2.2 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N	mitre

Weaknesses

CWE-749 Exposed Dangerous Method or Function

Affected Products

Product	Versions
ConvertigoConvertigo	8.3.4 and earlierAffected

References

https://github.com/convertigo/convertigo/issues/898
https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1
https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311
https://github.com/convertigo/convertigo/releases/tag/8.3.11

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.