Medium severity · published Jun 22, 2026
CVE-2025-62198
Apache Atlas: Stored XSS in Create Entity page
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Atlas · Apache Software Foundation
through 2.4.0 · source: vendor
AT
Atlas · Apache
before 2.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62198
Mailing List
https://lists.apache.org/thread/nv893lhz3ok08f25j3v4z1to5nrpdp7k
Mailing List
http://www.openwall.com/lists/oss-security/2026/06/20/1
More from Apache Atlas
8.8
CVE-2026-50622
Apache Atlas: Missing Authorization on Admin Endpoints
8.1
CVE-2026-40563
Apache Atlas: Script injection allows access to unintended data