High
CVE-2025-59844
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to b…
Tag: SonarQube Server
All CVEs associated with "SonarQube Server". Page 1/1 • 2 CVEs.
About “SonarQube Server”
A curated feed of “SonarQube Server”-related CVEs appears below. We currently track 2 CVEs for this tag (all time). In the last 365 days, 2 were published. Average CVSS is 7.8 (all time; 7.8 over 365d), and 100% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection').
In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: sonarqube-server
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | Premier Support | EOL | LTS |
|---|---|---|---|---|---|
| 2026.3 | 2026.3.1 | Soon | |||
| 2026.2 | 2026.2.1 | Expired | |||
| 2026.1 | 2026.1.3 | LTS | |||
| 2025.6 | 2025.6.1 | Unavailable | - | ||
| 2025.5 | 2025.5 | Expired | |||
| 2025.4 | 2025.4.7 | LTS | |||
| 2025.3 | 2025.3.1 | Expired | |||
| 2025.2 | 2025.2.0 | Expired | |||
| 2025.1 | 2025.1.8 | Soon | LTS | ||
| 10 | 10.8.0 | Expired | |||
| 9 | 9.9.8 | Expired | LTS | ||
| 8 | 8.9.10 | Expired | LTS | ||
| 7 | 7.9.6 | Expired | LTS |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “SonarQube Server” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2025-09-26
2025-09-02
High
CVE-2025-58178
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube…