Skip to content
OpenAdvisories
Medium · 6.1 CVE-2025-54057 EUVD-2025-199821GHSA-v6x2-4q87-rf82

Apache SkyWalking: Stored XSS vulnerability

Published Nov 27, 2025 · Updated Apr 13, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache SkyWalking Package: org.apache.skywalking:apm-webapp Ecosystem: Maven

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.

This issue affects Apache SkyWalking: <= 10.2.0.

Users are recommended to upgrade to version 10.3.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache SkyWalking ≤ 10.2.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.skywalking:apm-webapp <= 10.1.0 — GHSA-v6x2-4q87-rf82

References