oss-security - CVE-2025-49656: Apache Jena: Administrative users can create files outside the server directory space via the admin UI

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2c219aa8-e149-db8a-fa32-ff9b3fc32369@apache.org>
Date: Mon, 21 Jul 2025 07:22:53 +0000
From: Andy Seaborne <andy@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-49656: Apache Jena: Administrative users can create files
 outside the server directory space via the admin UI 

Severity: important 

Affected versions:

- Apache Jena through 5.4.0

Description:

Users with administrator access can create databases files outside the files area of the Fuseki server.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which fixes the issue.

Credit:

Noriaki Iwasaki; Cyber Defense Institute, Inc (reporter)

References:

https://jena.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-49656

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.