Read the docs
TI-2025-36435 Aliases CVE-2025-58782GHSA-cxvc-g8f2-4gmm

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Priority LOW 32CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01354 71st percentileScored 2026-11-07
Fix Partial org.apache.jackrabbit:jackrabbit-core (Maven): 2.22.2org.apache.jackrabbit:jackrabbit-jcr-commons (Maven): 2.22.2Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Jackrabbit Core1.0.0 – 2.22.1—No fix listedCNA
ApacheApache Jackrabbit JCR Commons1.0.0 – 2.22.1—No fix listedCNA
—org.apache.jackrabbit:jackrabbit-core (Maven)1.0.0 to before 2.22.22.22.2Patch availableGHSA-cxvc-g8f2-4gmm
—org.apache.jackrabbit:jackrabbit-jcr-commons (Maven)1.0.0 to before 2.22.22.22.2Patch availableGHSA-cxvc-g8f2-4gmm
  • Apache Jackrabbit Core VendorApache Affected 1.0.0 – 2.22.1 Fixed in — No fix listed CNA
  • Apache Jackrabbit JCR Commons VendorApache Affected 1.0.0 – 2.22.1 Fixed in — No fix listed CNA
  • org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 1.0.0 to before 2.22.2 Fixed in 2.22.2 Patch available GHSA-cxvc-g8f2-4gmm
  • org.apache.jackrabbit:jackrabbit-jcr-commons (Maven) Vendor— Affected 1.0.0 to before 2.22.2 Fixed in 2.22.2 Patch available GHSA-cxvc-g8f2-4gmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*1.0.0 to before 2.22.2VulnerableApache
  • cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* Versions 1.0.0 to before 2.22.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-cxvc-g8f2-4gmm org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.22.2 Advisory →
  • Fix · GHSA-cxvc-g8f2-4gmm org.apache.jackrabbit:jackrabbit-jcr-commons (Maven) Fixed in 2.22.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix planned: Will not fix
Not affected: 3 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58782
  2. 2026-10-03 Alias added: GHSA-cxvc-g8f2-4gmm

References

Advisory 3

Other 3

  • TI-2015-01646 XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before… CVSS 2.0MEDIUM 6.4
  • TI-2023-19328 Apache Jackrabbit RMI access can lead to RCE CVSS 3.1CRITICAL 9.8
  • TI-2026-69192 Session hijacking in Apache Jackrabbit WebDAV server CVSS 4.0CRITICAL 9.3
  • TI-2016-05842 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in… CVSS 3.0HIGH 8.8
  • TI-2009-00026 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2… CVSS 2.0MEDIUM 4.3
  • TI-2025-33606 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences