Is CVE-2025-58363 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-58363 being exploited in the wild.

How severe is CVE-2025-58363?

Medium severity, with a CVSS score of 5.5, published 9 September 2026.

Which products and versions are affected?

github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.1, SEMVER:introduced=0,fixed=2.4.1; LF Edge eKuiper < 2.4.1.

Is there a fix for CVE-2025-58363?

Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-58363 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-58363?

Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-58363: LF Edge eKuiper path traversal in plugin installation

Q: Is there a fix for CVE-2025-58363?

Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-58363 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2025-58363?

Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-58363 · Severity: medium · CVSS 5.5 · Published 2026-09-09

eKuiper is an edge computing platform used to process and manage IoT data streams. A path traversal flaw in its plugin installation feature allows attackers with management API access to delete arbitrary files on the server, potentially causing service outages or data loss. The vulnerability only enables deletion, not file creation or modification, but could still disrupt operations if critical system or application files are targeted.

Technologies: github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go), LF Edge eKuiper. Vendors: Go, LF Edge.

Quick answers

Is CVE-2025-58363 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-58363 being exploited in the wild.
How severe is CVE-2025-58363?: Medium severity, with a CVSS score of 5.5, published 9 September 2026.
Which products and versions are affected?: github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.1, SEMVER:introduced=0,fixed=2.4.1; LF Edge eKuiper < 2.4.1.
Is there a fix for CVE-2025-58363?: Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-58363 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-58363?: Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later
```
go get github.com/lf-edge/ekuiper/v2@v2.4.1
```

Technical details

The vulnerability is a classic path traversal (CWE-22) in the POST /plugins/* endpoint within internal/plugin/native/manager.go. The endpoint constructs a temporary directory path by directly concatenating user-supplied plugin names without proper validation, allowing attackers to inject path traversal sequences (e.g., ../../) that escape the intended plugin directory. When the deferred cleanup operation calls os.RemoveAll on the traversed path, arbitrary directories outside the plugin folder are deleted. The attack requires authentication/access to the management API on port 9081 and is constrained to file/directory deletion only. Patches are available in eKuiper version 2.4.1 and later, which enforce input validation using validate.ValidateID and path.VerifyFileName functions.

Affected products

LF Edge eKuiper < 2.4.1

Identifiers

CVE-2025-58363
GHSA-c23q-fw86-9h5x
GO-2026-6445

Timeline

2026-09-09: disclosed: Advisory published on GitHub
2026-09-09: patched: Fix released in eKuiper version 2.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.