CVE-2025-49794

Critical

Advisory

Published 16 Jun 2025In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 556; of 17,787 indexed, latest versions
Container images: 549; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 556 of 17,787 indexed charts deploy, on 549 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+35 more	2.9.1+dfsg1-3ubuntu4.13+esm8, 2.9.3+dfsg1-1ubuntu0.7+esm9, 2.9.4+dfsg1-6.1ubuntu1.9+esm4, 2.9.10+dfsg-5ubuntu0.20.04.10+esm1+3 more	485
libxml2apk	2.13.4-r3, 2.13.4-r5, 2.13.4-r6, 2.13.8-r0	2.13.9-r0	64

OSV records: ALPINE-CVE-2025-49794 DEBIAN-CVE-2025-49794 UBUNTU-CVE-2025-49794
Also known as: USN-7694-1

Charts affected

556 by stars

Chart

Latest

Affected images

Radar Score

giteawenerme

12.7.0

2 of 4 See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

8,811

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

15,230

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,624

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

11,577

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,673

Container images carrying it

549 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
bnjbvr/kresus :0.22.1	37e216b182c8	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
camunda/camunda-bpm-platform :latest	bcc5bb0542df	libxml2@2.13.8-r0	2.13.9-r0	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
castopod/castopod :1.12.10	1fd37280cbb2	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
chandanteekinavar/findery-market-frontend :1.0	6de5bd44a325	libxml2@2.13.4-r3	2.13.9-r0	1
chetangautamm/repo :sipp.v3	e7f7049e1544	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
cheyang/distributed-tf :1.6.0	46cc34755493	libxml2@2.9.3+dfsg1-1ubuntu0.5	2.9.3+dfsg1-1ubuntu0.7+esm9	1
chibisafe/chibisafe-server :latest	3da4fcbc1a18	libxml2@2.13.8-r0	2.13.9-r0	1
chriseaton/adventureworks :latest	54c3384ce701	libxml2@2.9.13+dfsg-1ubuntu0.6	2.9.13+dfsg-1ubuntu0.8	1
ckulka/baikal :0.10.1-nginx	434bdd162247	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3	1
cloudve/janis-terminal :latest	af56e77ca587	libxml2@2.9.4+dfsg1-6.1ubuntu1.3	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
countly/countly-server :25.05.4	e3c238248f99	libxml2@2.9.10+dfsg-5ubuntu0.20.04.2	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
dachichang/basic-auth-s3-nginx :1.0.0	7ccac90a935e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
dannielkil/book-frontend :latest	937993927694	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
ddosify/selfhosted_backend :3.2.9	3c11e3182652	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
deconzcommunity/deconz :2.29.2	062de2362641	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
dgraziotin/nginx-webdav-nononsense :1.23.1	38f2de42bed0	libxml2@2.9.10+dfsg-5ubuntu0.20.04.3	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
domainmod/domainmod :4.23.0	4017bfe4c597	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	libxml2@2.9.10+dfsg-5ubuntu0.20.04.10	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
elastictranscoder/transcoder :627e21dc	b4a0327029e6	libxml2@2.9.4+dfsg1-6.1ubuntu1.4	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
elastictranscoder/transcoder-handler :627e21dc	5b75d19e2733	libxml2@2.9.4+dfsg1-6.1ubuntu1.4	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
emqx/ecp-ui :2.5.1	e33e9816f147	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
engrmth/bnkr :2.1.0	6d8464e6f0e8	libxml2@2.9.10+dfsg-5ubuntu0.20.04.3	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
erenozcan17/react_frontend :v4.5	6e1b14973f9b	libxml2@2.13.8-r0	2.13.9-r0	1
esteban1930/frontend-1 :1.8.0	f9078279632c	libxml2@2.13.8-r0	2.13.9-r0	1
extrim/perlite :1.5.9	9cb7eb5598b6	libxml2@2.13.4-r5	2.13.9-r0	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.10	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
fnzv/dump1090 :latest	b3079b95c336	libxml2@2.9.13+dfsg-1ubuntu0.3	2.9.13+dfsg-1ubuntu0.8	1
galaxy/galaxy-init :v18.01	0267bad550e6	libxml2@2.9.1+dfsg1-3ubuntu4.12	2.9.1+dfsg1-3ubuntu4.13+esm8	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	libxml2@2.9.1+dfsg1-3ubuntu4.12	2.9.1+dfsg1-3ubuntu4.13+esm8	1
gchq/accumulo :2.0.1	c460bb587d6d	libxml2@2.9.14+dfsg-1.3ubuntu3.1	2.9.14+dfsg-1.3ubuntu3.4	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	libxml2@2.9.4+dfsg1-6.1ubuntu1.3	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
gethue/hue :4.11.0	11b649636e68	libxml2@2.9.10+dfsg-5ubuntu0.20.04.5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
gethue/hue :4.10.0	5702b2c37ff9	libxml2@2.9.4+dfsg1-6.1ubuntu1.3	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
gethue/hue :latest	7d5c1b9f8a79	libxml2@2.9.13+dfsg-1ubuntu0.7	2.9.13+dfsg-1ubuntu0.8	1
grafana/oncall :v1.16.5	499851658393	libxml2@2.13.4-r6	2.13.9-r0	1
guacamole/guacamole :1.5.5	0f62f6d17ab3	libxml2@2.9.13+dfsg-1ubuntu0.3	2.9.13+dfsg-1ubuntu0.8	1
gulacedia/web-dvwa-new :v3	67b467d961ca	libxml2@2.9.14+dfsg-1.2	2.9.14+dfsg-1.3~deb12u3	1
haugene/transmission-openvpn :4.0	059216cfae4b	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
haveagitgat/tdarr :2.00.18	1256348872ce	libxml2@2.9.10+dfsg-5ubuntu0.20.04.2	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
haveagitgat/tdarr_node :2.00.10	1e3f9328327d	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
hazegoodlife/haaze :veggiesite	50f02d2d5d4d	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
hazegoodlife/haaze :milksite	8d4c63169e14	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1