How severe is CVE-2025-58782?

CVE-2025-58782 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-58782 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-58782?

CVE-2025-58782 affects Apache Jackrabbit. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-58782?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-58782 have an EU (EUVD) identifier?

Yes. CVE-2025-58782 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27118.

When was CVE-2025-58782 published?

CVE-2025-58782 was published on 2025-09-08 and last updated on 2026-06-17.

CVE-2025-58782

CVE-2025-58782 is a medium-severity vulnerability in Apache Jackrabbit with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-502.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (67th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-27118
Weakness: CWE-502
Affected product: Apache Jackrabbit
Published: 2025-09-08
Last modified: 2026-06-17

Description

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Frequently asked questions

What is CVE-2025-58782?: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
How severe is CVE-2025-58782?: CVE-2025-58782 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-58782 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-58782?: CVE-2025-58782 affects Apache Jackrabbit. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-58782?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-58782 have an EU (EUVD) identifier?: Yes. CVE-2025-58782 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27118.
When was CVE-2025-58782 published?: CVE-2025-58782 was published on 2025-09-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Jackrabbit

CVE-2023-37895 — Critical (CVSS 9.8): Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute…
CVE-2025-53689 — High (CVSS 8.8): Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of…
CVE-2016-6801 — High (CVSS 8.8): Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache…
CVE-2015-1833 — Medium (CVSS 6.4): XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6,…
CVE-2009-0026 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject…

All CVEs affecting Apache Jackrabbit →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →