GHSA-xg9p-p463-3qjp

ghsaUSosv

Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access

view advisory published 2025-07-21Licence: CC-BY-4.0

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-50151US	—	1.07% (65th)	—	2025-07-21
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/07/21/2WEB
https://github.com/apache/jenaPACKAGE
https://lists.apache.org/thread/12gks5z40gh9bszn1xk8mz34gz586xssWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-50151ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan