Revision as of 07:58, 10 December 2025 by imported>Mglaser ((username removed) (log details removed))
| Date | 2025-12-09 |
| Severity | reported "critical", BlueSpice assessment: low |
| Affected | Services in current LTS version < 5.1.4 |
| Fixed in | 5.1.4 |
| CVE | CVE-2025-66516 |
Problem
- Service
bluespice/search- CVE-2025-66516
Impact assessment
- Service
bluespice/search- The issues has already been fixed in the upstream repository, but there was no official release yet
- A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.
Solution
To mitigate CVE-2025-66516 one can make sure the service has no access to the internet.
Update a soon as possible to Version 5.1.4 of the BlueSpice images
