Vulnerability Description
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Jackrabbit | >= 1.0.0, < 2.22.2 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6vMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/09/06/3Mailing ListThird Party Advisory
FAQ
What is CVE-2025-58782?
CVE-2025-58782 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JC...
How severe is CVE-2025-58782?
CVE-2025-58782 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-58782?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Jackrabbit.