Medium severity · published Jan 7, 2026
CVE-2025-58441
Knowage is vulnerable to blind server-side request forgery (SSRF)
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker should be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
Knowage-Server · KnowageLabs
< 8.1.37 · source: vendor
KN
Knowage · Eng
before 8.1.37 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58441
Vendor Advisory
https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-m6x8-wh9v-6jxp
More from Knowage-Server
9.8
CVE-2025-59954
Knowage Contains a Remote Code Execution Vulnerability
6.1
CVE-2022-39295
Improper Neutralization of Alternate XSS Syntax in Knowage-Server
5.3
CVE-2025-55007
Knowage vulnerable to server-side request forgery