Apache Jena: Administrative users can create files outside the server directory space via the admin UI
Priority MEDIUM 42CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01558 75th percentileScored 2026-11-08
Fix Partial org.apache.jena:jena-fuseki (Maven): 5.5.0Red Hat: 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Jena | up to 5.4.0 | — | No fix listed | CNA |
| — | org.apache.jena:jena-fuseki (Maven) | before 5.5.0 | 5.5.0 | Patch available | GHSA-jq2c-m8gg-mqcm |
- Apache Jena VendorApache Affected up to 5.4.0 Fixed in — No fix listed CNA
- org.apache.jena:jena-fuseki (Maven) Vendor— Affected before 5.5.0 Fixed in 5.5.0 Patch available GHSA-jq2c-m8gg-mqcm
Remediation
- Fix · GHSA-jq2c-m8gg-mqcm org.apache.jena:jena-fuseki (Maven) Fixed in 5.5.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49656
- 2026-10-03 Alias added: GHSA-jq2c-m8gg-mqcm
References
Advisory 2
More Apache Jena vulnerabilities
- TI-2022-11511 Processing external DTDs CVSS 3.1CRITICAL 9.8
- TI-2023-15499 Apache Jena: Exposure of execution in script engine expressions. CVSS 3.1HIGH 8.8
- TI-2025-32034 Apache Jena: Configuration files uploaded by administrative users are not check properly CVSS 3.1HIGH 8.8
- TI-2021-16624 XML external entity (XXE) in Apache Jena CVSS 3.1HIGH 7.5
- TI-2023-08840 Apache Jena: Exposure of arbitrary execution in script engine expressions. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-49656 · CVE Program
- CVE-2025-49656 · NVD
- FIRST EPSS
- GHSA-jq2c-m8gg-mqcm · GitHub Advisory Database · CC BY 4.0
- CVE-2025-49656 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences