Log in Start free

Vulnerability · Published Sep 8, 2025 · Assigned by apache

CVE-2025-58782Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Medium 6.5

In plain English

A medium-severity unsafe deserialization in Apache Jackrabbit Core from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.4%top 28.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jackrabbitno fix listedDEBIAN-CVE-2025-58782
Debian:13jackrabbitno fix listedDEBIAN-CVE-2025-58782
Debian:14jackrabbitno fix listedDEBIAN-CVE-2025-58782
Mavenorg.apache.jackrabbit:jackrabbit-core2.22.2GHSA-cxvc-g8f2-4gmm
Mavenorg.apache.jackrabbit:jackrabbit-jcr-commons2.22.2GHSA-cxvc-g8f2-4gmm
Ubuntu:22.04:LTSjackrabbitno fix listedUBUNTU-CVE-2025-58782
Ubuntu:24.04:LTSjackrabbitno fix listedUBUNTU-CVE-2025-58782
Ubuntu:25.10jackrabbitno fix listedUBUNTU-CVE-2025-58782
Ubuntu:26.04:LTSjackrabbitno fix listedUBUNTU-CVE-2025-58782
Ubuntu:26.10jackrabbitno fix listedUBUNTU-CVE-2025-58782

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Jackrabbit Core 1.0.0 – through 2.22.1
Apache Software Foundation Apache Jackrabbit JCR Commons 1.0.0 – through 2.22.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References