CVE-2025-58782
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons (versions 1.0.0 through 2.22.1). Deployments that accept JNDI URIs for JCR lookup from untrusted users allow them to inject malicious JNDI references, potentially leading to arbitrary code execution.
Risk Assessment
An attacker can inject malicious JNDI references and achieve arbitrary code execution, taking control of the application or server.
Recommendation
Upgrade to version 2.22.2, where JCR lookup through JNDI is disabled by default; if the feature is needed, enable it explicitly and review JNDI URI usage.
Other vulnerabilities in Apache Jackrabbit
See all- CVE-2016-6801High
CVE-2016-6801 involves a content-type check vulnerability in Jackrabbit-Webdav, allowing remote attackers to hijack the authentication of victims for resource creation via an HTTP POST request with a missing or crafted Content-Type header.
- CVE-2026-92414Critical
Session Fixation / Session Reuse vulnerability in Apache Jackrabbit. The WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match without credential check. Affects versions from 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.
- CVE-2026-92415Medium
A vulnerability of type "Use of Externally-Controlled Input to Select Classes or Code" in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH).
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS