CVE-2025-4949 is an XML External Entity (XXE) vulnerability in the Eclipse JGit component integrated into Red Hat JBoss Enterprise Application Platform 8. This vulnerability could allow an attacker to process malicious XML input leading to potential information disclosure or other impacts associated with XXE attacks. Red Hat has released version 8.1.2 of JBoss Enterprise Application Platform 8 to address this issue by upgrading the jgit component to version 6.10.1.202505221210-r-redhat-00002. The update also includes other bug fixes and enhancements. The vendor rates the security impact as Important (medium severity) and recommends applying the update after ensuring all previous errata are applied and backing up existing installations.

The vulnerability is an XXE issue in the Eclipse JGit library used by Red Hat JBoss Enterprise Application Platform 8, which could potentially allow attackers to exploit XML parsing to access unauthorized data or cause other impacts typical of XXE vulnerabilities. The vendor rates the impact as Important (medium severity). There are no known exploits in the wild at this time.

A security update is available in Red Hat JBoss Enterprise Application Platform 8.1.2 that fixes the XXE vulnerability by upgrading the Eclipse JGit component. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Backing up existing installations, including applications and configuration files, is recommended before applying the update. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.