Apache Jena: Configuration files uploaded by administrative users are not check properly
Priority MEDIUM 42CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01067 64th percentileScored 2026-11-07
Fix Partial org.apache.jena:jena (Maven): 5.5.0Red Hat: 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Jena | up to 5.4.0 | — | No fix listed | CNA |
| — | org.apache.jena:jena (Maven) | before 5.5.0 | 5.5.0 | Patch available | GHSA-xg9p-p463-3qjp |
- Apache Jena VendorApache Affected up to 5.4.0 Fixed in — No fix listed CNA
- org.apache.jena:jena (Maven) Vendor— Affected before 5.5.0 Fixed in 5.5.0 Patch available GHSA-xg9p-p463-3qjp
Remediation
- Fix · GHSA-xg9p-p463-3qjp org.apache.jena:jena (Maven) Fixed in 5.5.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50151
- 2026-10-03 Alias added: GHSA-xg9p-p463-3qjp
References
More Apache Jena vulnerabilities
- TI-2022-11511 Processing external DTDs CVSS 3.1CRITICAL 9.8
- TI-2023-15499 Apache Jena: Exposure of execution in script engine expressions. CVSS 3.1HIGH 8.8
- TI-2025-31627 Apache Jena: Administrative users can create files outside the server directory space via the admin UI CVSS 3.1HIGH 7.5
- TI-2021-16624 XML external entity (XXE) in Apache Jena CVSS 3.1HIGH 7.5
- TI-2023-08840 Apache Jena: Exposure of arbitrary execution in script engine expressions. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-50151 · CVE Program
- CVE-2025-50151 · NVD
- FIRST EPSS
- GHSA-xg9p-p463-3qjp · GitHub Advisory Database · CC BY 4.0
- CVE-2025-50151 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences