The vulnerability CVE-2025-12799 affects Red Hat JBoss Enterprise Application Platform versions before 8.1.7. It is due to improper input handling in the Jastow component, specifically when certain configurations allow unescaped characters in URLs processed by Undertow and Jastow. This leads to a Cross-Site Scripting (XSS) vulnerability where malicious scripts can be injected and executed in the context of the affected server. The issue is fixed in version 8.1.7 by upgrading the Jastow component to 2.2.9.SP1-redhat-00001 and related dependencies. The CVSS v3.1 base score is 6.5 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to unauthorized disclosure of information and modification of data. The CVSS score of 6.5 indicates a medium severity impact, with confidentiality and integrity impacts but no availability impact. No known exploits in the wild have been reported at this time.

A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.7 which addresses this vulnerability by upgrading the Jastow component and related dependencies. Users should apply this official patch to remediate the issue. Before updating, ensure all previous errata are applied and back up existing installations and configurations. Follow Red Hat's official guidance for applying the update as detailed in their advisory and documentation. No additional mitigation steps are indicated by the vendor.