Vulnerability · Published Sep 16, 2025 · Assigned by Jaspersoft
CVE-2025-10492Jaspersoft Library Deserialisation Vulnerability
High 8.7
In plain English
A high-severity unsafe deserialization in JasperReports IO At-Scale from Jaspersoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | net.sf.jasperreports:jasperreports | 7.0.4 | GHSA-7c3f-cg9x-f3gr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jaspersoft | JasperReports Library Community Edition | 0 – through 7.0.3 |
| Jaspersoft | Jaspersoft Studio Community Edition | 0 – through 7.0.3 |
| Jaspersoft | JasperReports Server | 0 – through 9.0.0 |
| Jaspersoft | JasperReports Library Professional | 0 – through 9.0.2 |
| Jaspersoft | Jaspersoft Studio Professional | 0 – through 9.0.2 |
| Jaspersoft | JasperReports IO Professional | 0 – through 4.0.0 |
| Jaspersoft | JasperReports IO At-Scale | 0 – through 4.0.0 |
| Jaspersoft | JasperReports Web Studio | 0 – through 3.0.1 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N