oss-sec mailing list archives

CVE-2025-50151: Apache Jena: Configuration files uploaded by administrative users are not check properly

From: Andy Seaborne <andy () apache org>
Date: Mon, 21 Jul 2025 07:23:02 +0000

Severity: important 

Affected versions:

- Apache Jena through <= 5.4.0

Description:

File access paths in configuration files uploaded by users with administrator access are not validated.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.

References:

https://jena.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-50151

Current thread:

CVE-2025-50151: Apache Jena: Configuration files uploaded by administrative users are not check properly Andy Seaborne (Jul 21)