Every CVE Search/ Get API key

CVE-2025-58782

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

6.5 MediumFix available

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.35%Up 1.3 points since Sep 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
CVE-2025-58782
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2025-27118 6.5

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
EUVD-2025-27118
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-cxvc-g8f2-4gmm 6.5

Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
GHSA-cxvc-g8f2-4gmm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
NVD 6.5

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
CVE-2025-58782
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
OSV 6.5

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
CVE-2025-58782
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
OSVDEBIAN-CVE-2025-58782 6.5

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
DEBIAN-CVE-2025-58782
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-cxvc-g8f2-4gmm 6.5

Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
GHSA-cxvc-g8f2-4gmm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-502
Updated
2026-11-02
OSVUBUNTU-CVE-2025-58782 6.5

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Record
UBUNTU-CVE-2025-58782
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.jackrabbit:jackrabbit-core
Maven
 1.0.0 up to 2.22.2
2.22.2
org.apache.jackrabbit:jackrabbit-jcr-commons
Maven
 1.0.0 up to 2.22.2
2.22.2
jackrabbit
Debian:12
 All versions, plus listed versions
2.20.11-12.20.11-1.12.20.3-1
 None known
jackrabbit
Debian:13
 All versions, plus listed versions
2.20.11-1.1
 None known
jackrabbit
Debian:14
 All versions, plus listed versions
2.20.11-1.1
 None known
org.apache.jackrabbit:jackrabbit-core
Maven
 1.0.0 up to 2.22.2, plus listed versions
1.01.0.11.11.1.11.2.1
Show 45 moreShow less
1.2.21.2.31.31.3.11.3.31.41.4.11.4.101.4.111.4.121.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.5.21.5.31.5.41.5.51.5.61.5.71.6.01.6.11.6.21.6.41.6.52.0-beta12.0-beta32.0-beta42.0-beta52.0-beta62.0.02.0.32.0.52.1.02.1.12.1.22.1.32.1.52.1.62.10.0
2.22.2
org.apache.jackrabbit:jackrabbit-jcr-commons
Maven
 1.0.0 up to 2.22.2, plus listed versions
1.01.0.11.11.1.11.2.1
Show 45 moreShow less
1.2.21.2.31.31.3.11.3.31.41.4.21.5.01.5.21.5.31.5.51.6.01.6.11.6.21.6.41.6.52.0-beta12.0-beta32.0-beta42.0-beta52.0-beta62.0.02.0.32.0.52.1.02.1.12.1.22.1.32.1.52.1.62.10.02.10.12.10.22.10.32.10.42.10.52.10.62.10.72.10.82.10.92.11.02.11.12.11.22.11.32.12.0
2.22.2
jackrabbit
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.3.6-12.3.6-1+deb8u1build0.14.04.12.3.6-1+deb8u2build0.14.04.1
 None known
jackrabbit
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.10.1-12.10.1-2
 None known
jackrabbit
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.12.6-12.14.4-1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
jackrabbit
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.18.0+r2.14.6-1
 None known
jackrabbit
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.18.0+r2.14.6-12.20.3-1
 None known
jackrabbit
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.20.11-1
 None known
jackrabbit
Ubuntu:25.10
 All versions, plus listed versions
2.20.11-12.20.11-1.1
 None known
jackrabbit
Ubuntu:26.10
 All versions, plus listed versions
2.20.11-1.1
 None known
jackrabbit
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.20.11-1.1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-58782 is a medium vulnerability (CVSS 6.5) in Apache Jackrabbit, published September 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in org.apache.jackrabbit:jackrabbit-core 2.22.2.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 377 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open