CVE-2025-43955

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-43955

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43955.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-43955

Published

2025-04-20T00:00:00Z

Modified

2026-10-28T10:40:40Z

Severity

2.2 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

Database specific

{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-749"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43955.json"
}

References

Affected packages

Git / github.com/convertigo/convertigo

Affected ranges

Type

GIT

Repo

https://github.com/convertigo/convertigo

Events

Introduced

Fixed

572cb7d16425ea66304d4143aae25a0bc8a2ae3e

Fixed

431d1bfeb360a55f4ed299cc3aa287cc5c6357e1

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:convertigo:convertigo:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "8.3.11"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "431d1bfeb360a55f4ed299cc3aa287cc5c6357e1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "8.3.11",
            "range": [
                {
                    "fixed": "572cb7d16425ea66304d4143aae25a0bc8a2ae3e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

6.*

6.0.0

6.1.0

6.1.1

6.1.2

7.*

7.0.0

7.1.0

7.2.0

7.3.0

7.4.0

7.4.1

7.4.2

7.5.0

7.6.0

8.*

8.0.0

8.0.1

8.0.2

8.1.0

8.2.0

8.3.0

8.3.10

8.3.2

8.3.3

8.3.4

8.3.5

8.3.6

8.3.7

8.3.8

8.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43955.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "138300023471986760477911939568397762320",
            "length": 781
        },
        "id": "CVE-2025-43955-0333db59",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1",
        "target": {
            "file": "engine/src/com/twinsoft/convertigo/engine/util/TwsCachedXPathAPI.java",
            "function": "selectList"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91494106475595540842734059106022339183",
                "213500837413335527599825861845672538238",
                "37507489785685358008319893804181226723",
                "59615455652915057957081413890134043375",
                "287144529836118375281032324385704380973",
                "272765437824718992674471073254842038960",
                "308810885826372392752763486772828910811",
                "237867893688906094959923546508019524252",
                "303393777598709252326304638141137586209",
                "286777339210556384980026288057692439673",
                "297635343074234071327959549494770805483",
                "310614783231285301527021970509101338977",
                "177961231800585469473464212457998640444",
                "62535345461186410189354148395563459220",
                "238029080806377923246794379426720765526"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-43955-aacdff33",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1",
        "target": {
            "file": "engine/src/com/twinsoft/convertigo/engine/util/TwsCachedXPathAPI.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "197516100857935510878643529302702056255",
            "length": 194
        },
        "id": "CVE-2025-43955-de7be021",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1",
        "target": {
            "file": "engine/src/com/twinsoft/convertigo/engine/util/TwsCachedXPathAPI.java",
            "function": "selectNode"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:40:40Z"