Vulnerability · Published Jul 21, 2025 · Assigned by apache
CVE-2025-50151Apache Jena: Configuration files uploaded by administrative users are not check properly
High 8.8
In plain English
A high-severity improper input validation in Apache Jena from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 35.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | apache-jena | no fix listed | DEBIAN-CVE-2025-50151 |
| Debian:13 | apache-jena | no fix listed | DEBIAN-CVE-2025-50151 |
| Debian:14 | apache-jena | no fix listed | DEBIAN-CVE-2025-50151 |
| Maven | org.apache.jena:jena | 5.5.0 | GHSA-xg9p-p463-3qjp |
| Ubuntu:22.04:LTS | apache-jena | no fix listed | UBUNTU-CVE-2025-50151 |
| Ubuntu:24.04:LTS | apache-jena | no fix listed | UBUNTU-CVE-2025-50151 |
| Ubuntu:25.10 | apache-jena | no fix listed | UBUNTU-CVE-2025-50151 |
| Ubuntu:26.04:LTS | apache-jena | no fix listed | UBUNTU-CVE-2025-50151 |
| Ubuntu:26.10 | apache-jena | no fix listed | UBUNTU-CVE-2025-50151 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Jena | 0 – through 5.4.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H