How severe is CVE-2025-12140?

CVE-2025-12140 has a CVSS 4.0 base score of 9.3, rated critical severity.

Is CVE-2025-12140 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-12140?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-12140 have an EU (EUVD) identifier?

Yes. CVE-2025-12140 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-199823.

When was CVE-2025-12140 published?

CVE-2025-12140 was published on 2025-11-27 and last updated on 2026-06-17.

CVE-2025-12140

CVE-2025-12140 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-95.

Key facts

Severity: Critical (CVSS 4.0 base score 9.3)
EPSS exploit prediction: 0% (28th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-199823
Weakness: CWE-95
Published: 2025-11-27
Last modified: 2026-06-17

Description

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353

Frequently asked questions

What is CVE-2025-12140?: The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353
How severe is CVE-2025-12140?: CVE-2025-12140 has a CVSS 4.0 base score of 9.3, rated critical severity.
Is CVE-2025-12140 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-12140?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-12140 have an EU (EUVD) identifier?: Yes. CVE-2025-12140 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-199823.
When was CVE-2025-12140 published?: CVE-2025-12140 was published on 2025-11-27 and last updated on 2026-06-17.

References

https://cert.pl/posts/2025/11/CVE-2025-12140/

Other CWE-95 (Eval Injection) vulnerabilities

CVE-2026-44643 — Critical (CVSS 10.0): Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an…
CVE-2025-68271 — Critical (CVSS 10.0): OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.…
CVE-2013-10070 — Critical (CVSS 10.0): PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names…
CVE-2022-36010 — Critical (CVSS 10.0): This library allows strings to be parsed as functions and stored as a specialized component,…
CVE-2026-1470 — Critical (CVSS 9.9): n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system.…
CVE-2023-29511 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with…

Browse all CWE-95 (Eval Injection) vulnerabilities →