|
|
|
| Date
|
2026-07-27
|
| Severity
|
reported "high", BlueSpice assessment: not affected / low
|
| Affected
|
bluespice/search Docker image (all versions)
bluespice/ai Docker image (5.3.x)
|
| Fixed in
|
Unknown
|
| CVE
|
|
Problem
| CVE
|
Component
|
Type of vulnerability
|
BlueSpice 5
|
| CVE-2025-14813
|
bluespice/search
|
Use of a Broken or Risky Cryptographic Algorithm
|
not affected
|
| CVE-2025-65896
|
bluespice/ai
|
SQL Injection via dictionary as params
|
not affected
|
| CVE-2026-59873
|
bluespice/ai, bluespice/chat, bluespice/formula, bluespice/wire
|
Allocation of Resources Without Limits or Throttling
|
not affected
|
| CVE-2026-59933
|
- Extension:BlueSpiceUEModuleTable2Excel
- Extension:DataTransfer
- Extension:SemanticResultFormats
|
- Uncontrolled Resource Consumption
- Loop with Unreachable Exit Condition ('Infinite Loop')
|
low
|
Impact assessment
| CVE
|
Assessment
|
Mitigation without update
|
| CVE-2025-14813
|
The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
|
No action required.
|
| CVE-2025-65896
|
Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|
No action required.
|
| CVE-2026-59873
|
None of the code makes use of the affected package / code (node-tar). In all but bluespice/formula it is just part of the base image content. In bluespice/formula, it is a transient dependency, but also not used. Not even in the dependency code.
|
No action required.
|
| CVE-2026-59933
|
Extension:BlueSpiceUEModuleTable2Excel and Extension:SemanticResultFormats don't use affected code at all. Only Extension:DataTransfer may be affected.
|
If concerned temporarily disable Special:ImportSpreadsheet via $DATA/wiki/bluespice/pre-init-settings.php.
\Hooks::register( 'SpecialPage_initList', static function( &$specialPages ) {
unset( $list['ImportSpreadsheet'] );
});
|
Solution
No immediate action required. If concerned about CVE-2026-59933, apply the temporary fix. CVE-2026-59933 will be fixed in one of the next patch releases.
