CVE-2025-49656CWE-22

Apache Jena: Administrative users can create files outside the server directory space via the admin UI

High · published July 21, 2025

CVSS v3.1
7.5
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

Users with administrator access can create databases files outside the files area of the Fuseki server.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01558 · 75.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-07-21T09:30Z
EPSS history
Timeline
  • 21 JUL 09:30Z
    Apache Jena: Administrative users can create files outside the server directory space via the admin UI
    cvelistv5