Read the docs
TI-2026-69193 Aliases CVE-2026-92415GHSA-f7m4-mw9m-xwg5

Apache Jackrabbit DavEx client can instantiate arbitrary classes

Priority LOW 37CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Apache Jackrabbit from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4 and from 2.20.0 through 2.20.17 has a flaw in its DavEx client where external input selects classes to instantiate (CWE-470). A malicious WebDAV/DavEx server, or an attacker intercepting the connection, can make the client instantiate arbitrary classes from its classpath, enabling arbitrary file creation or truncation. Only applications using jackrabbit-spi2dav, directly or through jackrabbit-jcr2dav, are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Jackrabbit2.23.0 – 2.23.5; 2.22.0 – 2.22.4; 2.20.0 – 2.20.17—No fix listedCNA
  • Apache Jackrabbit VendorApache Affected 2.23.0 – 2.23.5; 2.22.0 – 2.22.4; 2.20.0 – 2.20.17 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*2.20.0 to before 2.20.18; 2.22.0 to before 2.22.5; 2.23.0 to before 2.23.6VulnerableApache
  • cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* Versions 2.20.0 to before 2.20.18; 2.22.0 to before 2.22.5; 2.23.0 to before 2.23.6 Vulnerable ·Apache

Remediation

Upgrade Apache Jackrabbit to version 2.23.6, 2.22.5 or 2.20.18, which fix the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-92415
  2. 2026-10-07 Alias added: GHSA-f7m4-mw9m-xwg5
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → LOW
  5. 2026-10-13 CVSS score added · NVD

References

Advisory 2

  • TI-2015-01646 XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before… CVSS 2.0MEDIUM 6.4
  • TI-2023-19328 Apache Jackrabbit RMI access can lead to RCE CVSS 3.1CRITICAL 9.8
  • TI-2026-69192 Session hijacking in Apache Jackrabbit WebDAV server CVSS 4.0CRITICAL 9.3
  • TI-2016-05842 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in… CVSS 3.0HIGH 8.8
  • TI-2009-00026 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2… CVSS 2.0MEDIUM 4.3
  • TI-2025-33606 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences