Security:Security Advisories/BSSA-2025-07: Difference between revisions

Latest revision as of 08:03, 10 December 2025



Date	2025-12-09
Severity	reported "critical", BlueSpice assessment: low
Affected	Services in current LTS version < 5.1.4
Fixed in	5.1.4
CVE	CVE-2025-66516

Service bluespice/search
- A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.

To mitigate CVE-2025-66516 , make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.

Update to version 5.1.4 of the BlueSpice images.

@@ Line 23: / Line 23: @@
 * Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025-66516 CVE-2025-66516]
 ==Impact assessment==
 * Service <code>bluespice/search</code>
-** The issues has already been fixed in the upstream repository, but there was no official release yet
 ** A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.
 == Solution ==
-To mitigate <code>CVE-2025-66516</code> one can make sure the service has no access to the internet.
+To mitigate <code>CVE-2025-66516</code> , make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
-Update a soon as possible to Version 5.1.4 of the BlueSpice images
+Update to version 5.1.4 of the BlueSpice images.