CVE-2025-58146
Severity CVSS v4.0:
CRITICAL
Type:
CWE-20
Input Validation
Publication date:
09/07/2026
Last modified:
09/07/2026
Description
There are multiple issues.<br />
<br />
1. Updates to the XAPI database sanitise input strings, but try<br />
generating the notification using the unsanitised input. This<br />
causes the database&#39;s event thread to terminate and cease further<br />
processing.<br />
<br />
2. XAPI&#39;s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI<br />
uses libraries which conform to the stricter v3.1 of the Unicode<br />
spec. This causes some strings to be accepted as valid UTF-8 by<br />
XAPI, but rejected by other libraries in use. Notably, such strings<br />
can be entered into the database, after which the database can no<br />
longer be loaded.<br />
<br />
3. There is no input sanitisation for Map/Set updates on objects in the<br />
XAPI database.
Impact
Base Score 4.0
9.40
Severity 4.0
CRITICAL