CVE-2025-49795

High

Advisory

Published 16 Jun 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 65; of 17,781 indexed, latest versions
Container images: 64; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 65 of 17,781 indexed charts deploy, on 64 images.

Affected package	Affected versions	Fixed in	Images
libxml2apk	2.13.4-r3, 2.13.4-r5, 2.13.4-r6, 2.13.8-r0	2.13.9-r0	64

OSV records: ALPINE-CVE-2025-49795

Charts affected

65 by stars

Chart

Latest

Affected images

Radar Score

osdfir-infrastructureosdfir-infrastructure

2.15.0

2 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
library/postgres :17.5-alpine	6567bca8d7bc	libxml2@2.13.8-r0	2.13.9-r0
library/postgres :17.2-alpine	7e5df973a748	libxml2@2.13.4-r3	2.13.9-r0

Open the chart page →

71,208

parcial-1parcial-1-chart

1.0.0

2 of 5 See more

parcial-1 parcial-1-chart 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
esteban1930/frontend-1 :1.8.0	f9078279632c	libxml2@2.13.8-r0	2.13.9-r0
registry.k8s.io/ingress-nginx/controller :v1.13.1	37e489b22ac7	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

3,844

cloudflaredpascaliske

3.0.0

1 of 1 See more

cloudflared pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/crazy-max/cloudflared :2025.9.1	9b4e856d18f6	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

2,028

prompt-dbprompt-db

1.0.7

1 of 3 See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/erlkoenig91/prompt-db-frontend :1.0.7	121dc29eb14d	libxml2@2.13.4-r5	2.13.9-r0

Open the chart page →

3,332

radar-upload-connect-frontendradar-base

0.8.1

1 of 1 See more

radar-upload-connect-frontend radar-base 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-frontend :0.6.4	7e27863545fc	libxml2@2.13.4-r5	2.13.9-r0

Open the chart page →

936

wallosrm3l

0.1.0

1 of 1 See more

wallos rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/ellite/wallos :2.46.0	9ce55520e7bd	libxml2@2.13.4-r3	2.13.9-r0

Open the chart page →

1,529

karakeeprtomik-helm-charts

0.0.1

1 of 3 See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

5,338

recipyartomik-helm-charts

0.0.2

1 of 2 See more

recipya rtomik-helm-charts 0.0.2

1 of the 2 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
reaper99/recipya :v1.2.2	7f7ec3aeb88c	libxml2@2.13.4-r3	2.13.9-r0

Open the chart page →

2,066

ed-deploymentscaleway-charts

0.1.0

1 of 1 See more

ed-deployment scaleway-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
nginxdemos/hello :plain-text	751bf8933179	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

1,291

scapyscapy-containerised

0.3.4

1 of 2 See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
saidsef/scapy-containerised :v2025.02	f17f7c435891	libxml2@2.13.4-r3	2.13.9-r0

Open the chart page →

2,817

seed-audio-ai-pwa-toolkitseed-audio-ai-pwa-helm-charts

0.1.0

1 of 1 See more

seed-audio-ai-pwa-toolkit seed-audio-ai-pwa-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
library/nginx :1.27-alpine	65645c7bb6a0	libxml2@2.13.4-r5	2.13.9-r0

Open the chart page →

840

return-nginx-chartseture

0.1.0

1 of 1 See more

return-nginx-chart seture 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
seyiogunniran/my-nginx :1.0	3a0ed39e5830	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

1,291

todolist-charttodolist-chart

0.1.7

1 of 10 See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
erenozcan17/react_frontend :v4.5	6e1b14973f9b	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

6,973

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
vcnngr/pnfrontend :latest	4e4979ab8c41	libxml2@2.13.8-r0	2.13.9-r0

Open the chart page →

4,768

colanodevictorlane

0.3.3

1 of 3 See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2025-49795.

Container image	Digest	Package	Fixed in
ghcr.io/colanode/web :latest	bcad696f03ee	libxml2@2.13.4-r5	2.13.9-r0

Open the chart page →

2,076

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/erlkoenig91/prompt-db-frontend :1.0.7	121dc29eb14d	libxml2@2.13.4-r5	2.13.9-r0	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	libxml2@2.13.4-r3	2.13.9-r0	1
ghcr.io/home-operations/beets :2.3.1	cc4975f1a0be	libxml2@2.13.8-r0	2.13.9-r0	1
ghcr.io/huscker/townsquare-frontend :2.15.2	dc6384d10cc8	libxml2@2.13.4-r6	2.13.9-r0	1
ghcr.io/jaydee94/kubeseal-webgui/ui :4.5.3	4447636e8102	libxml2@2.13.4-r6	2.13.9-r0	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	libxml2@2.13.8-r0	2.13.9-r0	1
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	libxml2@2.13.8-r0	2.13.9-r0	1
ghcr.io/linuxserver/bookstack :version-v24.12.1	cc795b254b73	libxml2@2.13.4-r3	2.13.9-r0	1
ghcr.io/linuxserver/healthchecks :version-v3.9	b5c6bfb00b03	libxml2@2.13.4-r5	2.13.9-r0	1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-frontend :0.6.4	7e27863545fc	libxml2@2.13.4-r5	2.13.9-r0	1
ghcr.io/zystem-io/zymtrace-pub-ui :26.9.1	e951adf792cd	libxml2@2.13.8-r0	2.13.9-r0	1
registry.k8s.io/ingress-nginx/controller :v1.13.2	1f7eaeb01933	libxml2@2.13.8-r0	2.13.9-r0	1
registry.k8s.io/ingress-nginx/controller :v1.13.1	37e489b22ac7	libxml2@2.13.8-r0	2.13.9-r0	1
registry.k8s.io/ingress-nginx/controller :v1.12.0	e6b8de175acd	libxml2@2.13.4-r3	2.13.9-r0	1