External risk intelligence

Convertigo XPath Expression Injection Vulnerability.

CVE advisorySeverity: MEDIUM (CVSS 6.8)

CVE-2025-43955

Convertigo is a low-code platform commonly deployed to host web applications, APIs, and mobile backends. As these platforms are typically exposed to the internet to serve end-users or external client applications, the attack surface created by an injection vulnerability in its API processing engine is likely to be reachable from the public internet in standard deployments.

Convertigo

before 8.3.11

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability identified in Convertigo's XPath processing, which could allow for expression injection. While the exact business impact is uncertain without further context, the nature of this vulnerability means that if Convertigo is used in externally facing applications, unauthorized access and data manipulation could be possible. The primary concern is to confirm if your organization utilizes this technology and assess the potential exposure.

Unrestricted functions in XPath processing.
Critical vulnerability could impact external applications.
Confirm Convertigo use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the TwsCachedXPathAPI in Convertigo by sending specially crafted requests that include malicious XPath expressions. This could occur in situations where an attacker has the ability to influence the evaluated XPath expression, potentially leading to unauthorized access, modification of data, or disruption of service.

No authentication required.
Attacker influences XPath expression.
Leads to expression injection.

Live Threat

Current exploitation, exposure, and threat context

In contexts where an attacker can influence an evaluated XPath expression, this vulnerability could allow expression injection, potentially affecting service behavior and sensitive information.

System data and service behavior at risk.
Expression injection when input is influenced.
Compromised service integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Convertigo platform, often used for web applications and APIs, is likely managed by application owners and platform teams, with network and security teams overseeing external access. The immediate priority is to identify all Convertigo instances, assess their external reachability and business criticality, and pinpoint the accountable owners for each. Remediation planning should follow, prioritizing the most exposed and critical assets.

Identify Convertigo instances and accountable owners.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Convertigo platform used for?

Convertigo is a low-code development platform that teams use to build and host web applications, mobile backends, and APIs. It functions as a middleware layer that often handles data processing and integration between frontend user interfaces and backend services.

How does the CVE-2025-43955 expression injection work?

This vulnerability is an injection flaw categorized as CWE-74 and CWE-749. It occurs because the TwsCachedXPathAPI component previously failed to restrict specific functions within its XPath engine. If an attacker can provide input that influences an evaluated XPath expression, they may be able to force the system to execute unauthorized functions, potentially compromising service integrity.

Do I need specific access to trigger CVE-2025-43955?

Yes, an attacker must have a mechanism to influence the XPath expressions processed by the application. This typically requires a scenario where user-supplied input is directly incorporated into an XPath query. If your implementation does not pass untrusted user input into XPath evaluators, this specific trigger path is not present.

Is my Convertigo deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that Convertigo is often deployed to serve external traffic, such as public-facing web applications or mobile APIs. Because these instances are frequently reachable from the internet by design, an injection vulnerability in the underlying API processing engine is likely to be accessible to remote, unauthenticated attackers.

How should I respond to this vulnerability?

The primary step is to identify all running instances of Convertigo within your environment to determine which are reachable from the internet. Once located, verify their current version; versions prior to 8.3.11 are affected. Prioritize upgrading these systems, as version 8.3.11 remediates the issue by applying an empty FunctionLibrary to restrict JXPath contexts.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.