CVE-2025-48006 XML external entity in DataSpider Servista
Attackers can read arbitrary files or cause denial of service via crafted XML requests in DataSpider Servista.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48006?
CVE-2025-48006 is a high-severity vulnerability in Saison Technology Co.,Ltd. DataSpider Servista, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service (DoS) condition may occur.
Weakness: CWE-611
Which versions are affected by CVE-2025-48006?
It affects 1 product.
Products include Saison Dataspider Servista.
How do I fix CVE-2025-48006?
No fix has been published for CVE-2025-48006 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-48006 being exploited?
There is no known exploitation of CVE-2025-48006 in the wild and no public exploit code.
Other vulnerabilities in Saison Technology Co.,Ltd. DataSpider Servista
Sources
Also known as GHSA-44q2-5cm4-72hw.