CVE-2025-48006 is a critical XML external entity flaw (CVSS 9.1) in DataSpider Servista 4.4 and earlier. A specially crafted request can make the server read arbitrary files or cause a denial of service. JVN says to update to the latest version, and some OEM products are affected too.
What's affected
Per the CVE record and the JVN advisory, DataSpider Servista 4.4 and earlier are affected. DataSpider Servista is a data integration product from Saison Technology.
JVN adds that some OEM products built on it are also affected, and lists a TerraSky notice for DCSpider. If you run a product from a reseller or partner that embeds this software, check that vendor's notice for the version mapping.
The JVN advisory gives the fix as updating to the latest version according to the developer's information. It does not name a specific fixed build in the part we read, and the vendor notice is a PDF in Japanese, so confirm the exact version you need against that notice.
The record files the issue under CWE-611 (XML External Entity Reference). The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H: network reachable, no privileges, no interaction, with high confidentiality impact and high availability impact.
How to check if you're exposed
Open the product's version screen or installation directory and note the version. Anything at 4.4 or earlier is in scope.
Then work out whether you have it indirectly. If your organisation bought an integration or ETL tool from a partner, ask the supplier whether it is built on DataSpider Servista and which release it contains. The vendor notice lists OEM products, so a supplier should be able to answer directly.
Next, review who can send requests to the server. XML processing flaws are reached by sending a crafted request, so exposure depends on which networks can reach the service. Check firewall rules and any reverse proxy in front of it.
Finally, look at what files the service account can read. If the account runs with wide read access, a file disclosure flaw reaches further. That is worth narrowing whichever version you run.
What to do now
- Read the Saison Technology notice linked from the JVN advisory and identify the fixed release for your product line.
- Update DataSpider Servista, and any OEM product built on it, to the version the vendor names.
- Restrict network access to the server to the systems and people that need it, until the update is done.
- Run the service under an account that can read only what it needs, and keep secrets and key files out of its reach.
- Review service logs for unusual requests to the server around and since the disclosure date of 29 September 2025.
- Ask OEM and reseller suppliers in writing which of their products embed this software.
Why it matters
XML lets a document refer to external resources, including files on the machine that parses it. A parser that follows those references without limits can be made to read local files and place their content into the response, or to hang while it processes something it should have refused. That is what the record means by reading arbitrary files or causing a denial of service.
The class is XML external entity processing. The standard fix is to turn off external entity and document type definition handling in the parser, so that a document cannot reach outside itself. Because the parser lives inside a data integration server, which tends to hold credentials for many other systems, a file read there can point to the next target.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. The 9.1 score reflects a flaw that is reachable without credentials and affects both data exposure and availability.
Quick check
Is there a specific fixed version for CVE-2025-48006?
JVN says to update to the latest version per the developer. The exact build is in the vendor notice, a PDF in Japanese, so confirm it there before you plan the change.
Does this affect products from other vendors?
JVN says some OEM products are affected and lists a TerraSky notice for DCSpider. Ask any supplier whose tool is built on DataSpider Servista.
Sources
Last reviewed: 18 October 2026.
