CVE-2025-59954: Critical Remote Code Execution in Knowage

CVE-2025-59954 is a critical (CVSS 9.8) remote code execution flaw in Knowage, the open source analytics and business intelligence suite. Versions 8.1.26 and below use an unsafe JXPath context in MetaService.java. The fix is version 8.1.27, and the advisory also lists 8.2.0 as patched.

What's affected

• Product: Knowage Server, an open source analytics and business intelligence suite.
• Weakness: CWE-94, code injection.
• Affected: versions 8.1.26 and below. The advisory says versions before 8.1.27.
• Fixed: 8.1.27, and 8.2.0 or later per the advisory.
• Component: the metadata service, in MetaService.java, which uses org.apache.commons.jxpath.JXPathContext unsafely.
• CVSS 3.1: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Source note: the CVE vector says no privileges are required. The advisory says a normal logged-in user can reach the function. Plan as though any account on the platform is enough, and do not rely on the login screen as a barrier.

How to check if you're exposed

Find your Knowage version in the application's about or admin pages, or from the container image tag if you use the official Docker setup:

docker image ls | grep -i knowage
docker ps --format '{{.Names}} {{.Image}}' | grep -i knowage

For WAR deployments, check the artifact version in your application server's deployment directory.

Anything at 8.1.26 or earlier is affected. Also note who has accounts. The advisory describes a regular user reaching the vulnerable function, so a deployment with many standard users, partner logins or self-registration carries more risk than a single-team install.

If Knowage is reachable from the internet, treat that as an extra priority signal and check your web logs for unusual requests to the metadata web service paths.

What to do now

1. Upgrade Knowage to 8.1.27 or later, or move to the 8.2.0 line, following the project release notes.
2. If an immediate upgrade is not possible, restrict network access to Knowage to trusted users and remove accounts that are not needed.
3. Review who holds accounts, especially low-privilege ones, since the advisory describes a normal user as enough.
4. Check application and web server logs for unexpected activity on the metadata service, and review the host for unexpected processes or new files.
5. Run Knowage with a minimal operating system account and limited outbound network access to reduce what code execution could reach.
6. Scan the repositories and images that ship Knowage with the free in-browser dependency scan.

Why it matters

JXPath lets a program evaluate path expressions against objects. The advisory says the metadata service used it in a way that let a user run commands on the server. That is the pattern behind CWE-94: input is treated as code or as an expression with access to code, instead of plain data.

Expression and template languages are a recurring source of remote code execution. They are built to be powerful, so safe use means locking them to a fixed set of allowed operations and never feeding them user-controlled text unchecked.

Impact is full: the vector rates confidentiality, integrity and availability as high. Business intelligence servers also tend to hold database credentials and sensitive reporting data, which raises the stakes. The record does not mark this vulnerability as exploited in the wild, and it is not in the CISA KEV catalog. Reachability matters here: if the metadata service is exposed to your users, treat this as urgent.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• github.com/KnowageLabs/Knowage-Server/security/advisories/GH (fetched)
• Safeguard Gold entry for CVE-2025-59954
• github.com/KnowageLabs/Knowage-Server/commit/1bb60d42557724f (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.