CVE-2025-57738
High · 7.2Apache Syncope allows malicious administrators to inject Groovy code
CVSS
7.2
EPSS
23.2%
Published
Oct 20, 2025
CISA due date
—
The record
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.syncope.core:syncope-core-spring | 0 | 3.0.14 |
| Maven | org.apache.syncope.core:syncope-core-spring | 4.0.0-M0 | 4.0.2 |
| maven | org.apache.syncope.core/syncope-core-spring | 4.0.0-M0 | 4.0.2 |
Related vulnerabilities
- CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
- CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
- GHSA-gqmf-56h7-rrpf npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware… CWE-653
- CVE-2026-41155 An attacker could cooperatively pass data from one secure GPU process to another secure… CWE-653
- CVE-2026-42782 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
- CVE-2026-44009 vm2 is an open source vm/sandbox for Node.js. CWE-653
- CVE-2026-44005 vm2 is an open source vm/sandbox for Node.js. CWE-653
- CVE-2026-43997 vm2 is an open source vm/sandbox for Node.js. CWE-653