What is the CVSS score of CVE-2025-43955?

CVE-2025-43955 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Convertigo are affected by CVE-2025-43955?

Convertigo's TwsCachedXPathAPI in versions through 8.3.4 contains a critical vulnerability enabling remote code execution through arbitrary Java extension function invocation; publicly available…

Is there a public PoC exploit available for CVE-2025-43955?

Yes, a public proof-of-concept exploit is available for CVE-2025-43955. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-43955?

Within 24 hours, identify all Convertigo instances running version 8.3.4 or earlier and determine whether TwsCachedXPathAPI is exposed to untrusted networks. Within 7 days, implement network segmentation to restrict TwsCachedXPathAPI access to trusted systems only, deploy WAF rules to block malicious XPath expressions and extension function invocations, and enable comprehensive audit logging of all XPath processing activities. Within 30 days, monitor Convertigo vendor advisories for patched version availability, conduct testing in non-production environments, and plan production upgrades; maintain interim compensating controls for any instances that cannot be immediately patched.

Convertigo CVE-2025-43955

CRITICAL

Exposed Dangerous Method or Function (CWE-749)

2025-04-20 cve@mitre.org

Information Disclosure Convertigo

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

jxpath function abuse yields high C/I/A, but exploitation depends on attacker-influenced XPath reaching the API, so AC:H and PR:L rather than the NVD's AC:L/PR:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 26, 2026 - 16:29 vuln.today

Analysis Updated

Aug 26, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 26, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Aug 26, 2026 - 16:22 NVD

LOW CRITICAL

CVSS changed

Aug 26, 2026 - 16:22 NVD

2.2 (LOW) 9.8 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 18:37 vuln.today

PoC Detected

May 13, 2025 - 14:26 vuln.today

Public exploit code

CVE Published

Apr 20, 2025 - 20:15 nvd

LOW 2.2

DescriptionNVD

TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs.

AnalysisAI

Unrestricted use of Apache commons-jxpath in Convertigo's TwsCachedXPathAPI (through version 8.3.4) lets XPath expressions invoke arbitrary Java extension functions, exposing the low-code platform to code execution and data exposure via crafted XPath. The upstream fix in 8.3.11 wraps every JXPath context with an empty FunctionLibrary, disabling extension-function resolution. Publicly available proof-of-concept exists via the project's own GitHub issue #898, though EPSS remains low at 0.13% (32nd percentile) and it is not on CISA KEV.

Technical ContextAI

Convertigo is a low-code/no-code enterprise mobile and web application platform. The affected component, com.twinsoft.convertigo.engine.util.TwsCachedXPathAPI, evaluates XPath queries against DOM nodes using Apache commons-jxpath (JXPathContext.selectNodes/selectSingleNode). JXPath supports extension functions that can reflectively call arbitrary Java methods and constructors within an XPath expression; when the context's function library is left at its permissive default, an expression can reach dangerous classes. This maps to CWE-749 (Exposed Dangerous Method or Function): a powerful capability of the underlying library is left reachable without restriction. The fix commit 431d1bfe introduces newSafeContext(), which calls context.setFunctions(new FunctionLibrary()) - an empty library - to strip extension-function access from every evaluation path.

RemediationAI

Upgrade to Convertigo 8.3.11 or later, which restricts jxpath by setting an empty FunctionLibrary on every XPath context (Vendor-released patch: 8.3.11; see https://github.com/convertigo/convertigo/releases/tag/8.3.11 and commit 431d1bfeb360a55f4ed299cc3aa287cc5c6357e1). If you cannot upgrade immediately, avoid passing any untrusted or user-supplied data into XPath expressions evaluated by sequences/transactions, and audit projects for XPath steps that incorporate external input - the trade-off is that this requires manual review of every project. As a network-level compensating control, restrict access to the Convertigo engine endpoints to trusted operators via a reverse proxy or firewall, accepting that this reduces exposure but does not remove the underlying capability. Backporting the newSafeContext() change (calling context.setFunctions(new FunctionLibrary())) is a targeted source-level workaround for self-built deployments.