Login Request a demo
Medium severity · published Sep 8, 2025
CVE-2025-58782
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jackrabbit · Apache
1.0.0 before 2.22.2 · source: NVD
Affected product
JA
Jackrabbit
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58782
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58782
Mailing List
https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v
Mailing List
http://www.openwall.com/lists/oss-security/2025/09/06/3
More from Jackrabbit
9.8
CVE-2023-37895
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable…
9.1
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
8.8
CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges
8.8
CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before…
5.3
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies