CVE-2025-58782
Reported by apache · Published September 8, 2025
jackrabbit-jcr-commons is fixed in 2.22.2 and 2.22.1 (Maven Central)
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.jackrabbit:jackrabbit-jcr-commons | Maven Central | 2.22.2, 2.22.1 |
| org.apache.jackrabbit:jackrabbit-core | Maven Central | 2.22.2, 2.22.1 |
| jackrabbit | apache | 2.22.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Jackrabbit Core | 1.0.0 |
| Apache Software Foundation | Apache Jackrabbit JCR Commons | 1.0.0 |
| Apache Software Foundation | Apache Jackrabbit JCR Commons | 1.0.0 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 1.0.0 |
| Apache Software Foundation | Apache Jackrabbit Core | 1.0.0 |
| Maven | org.apache.jackrabbit:jackrabbit-jcr-commons | 1.0.0 |
Timeline
- Sep 6, 2025 PoC Published (6 in total, the first dated here)
- Sep 7, 2025 CVE Published
- Sep 8, 2025 EPSS Score (30 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
- Apr 22, 2026 Security Advisory
- Aug 11, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-58782
vulnetix vdb fixes CVE-2025-58782Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-58782/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- vendor-advisory
- http://www.openwall.com/lists/oss-security/2025/09/06/3 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-58782 advisory
- https://github.com/advisories/GHSA-cxvc-g8f2-4gmm advisory
- https://github.com/apache/jackrabbit/pull/229 patch
- https://github.com/apache/jackrabbit url
- https://issues.apache.org/jira/browse/JCR-5135 url