PT-2025-48241 · Unknown · Apache Skywalking

Published 2025-11-27 · Updated 2026-04-13 · CVE-2025-54057

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache SkyWalking versions prior to 10.3.0

Description The software contains an Improper Neutralization of Script-Related HTML Tags in a Web Page issue, also known as a Basic Cross-Site Scripting (XSS) flaw. This allows attackers to inject malicious JavaScript into SkyWalking UI fields, potentially leading to persistent XSS, session hijacking, and unauthorized actions when administrators view compromised pages. The flaw is due to improper sanitization in multiple input fields within the SkyWalking UI. Approximately 2,600 potentially affected devices have been identified.

Recommendations Upgrade to version 10.3.0 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-54057

GHSA-V6X2-4Q87-RF82

Affected Products

Apache Skywalking

References · 18

• https://osv.dev/vulnerability/GHSA-v6x2-4q87-rf82 · Vendor Advisory
• https://lists.apache.org/thread/sl2x2tx8y007x0mo746yddx2lvnv9tcr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54057 · Security Note
• https://github.com/apache/skywalking · Note
• https://twitter.com/Komodosec/status/2007285840972787816 · Twitter Post
• https://t.me/pentestingnews/71266 · Telegram Post
• https://twitter.com/ransomnews/status/1993992445487665296 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/13/3 · Note
• https://t.me/CVEtracker/38386 · Telegram Post
• http://openwall.com/lists/oss-security/2025/11/27/1 · Note
• https://twitter.com/CVEnew/status/1994021422604132733 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1995222351886110733 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1pafq0u/top_10_trending_cves_30112025 · Reddit Post
• https://twitter.com/oss_security/status/1996686575443521798 · Twitter Post