Critical severity9.8NVD Advisory· Published Sep 30, 2025· Updated Jun 17, 2026

CVE-2025-59954

Description

Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Eng/Knowage
cpe:2.3:a:eng:knowage:*:*:*:*:*:*:*:*
Range: <8.1.27
Knowagelabs/Knowage Serverllm-fuzzy2 versions
<=8.1.26+ 1 more
- (no CPE)range: <=8.1.26
- (no CPE)range: < 8.1.27
Knowagelabs/Knowagellm-fuzzy
Range: <=8.1.26

Patches

Vulnerability mechanics

References

github.com/KnowageLabs/Knowage-Server/commit/1bb60d42557724f7ed24c19df6c5017e169527canvdPatch
github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgqnvdExploitVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000