Security Alert: Apache SkyWalking Stored XSS Vulnerability (CVE-2025-54057)

Apache SkyWalking, an open-source Application Performance Monitoring (APM) system, has released a critical update addressing a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-54057). This vulnerability allows attackers to compromise dashboards and administrators by injecting malicious scripts that execute automatically when users access affected pages. The flaw arises from insufficient validation of URLs for widgets, enabling persistent malicious payloads.

The Apache SkyWalking team recommends users upgrade to version 10.3.0 to mitigate risks associated with this vulnerability, which could lead to session hijacking, user redirection, and data manipulation.