CVE-2025-10492

Jaspersoft Library Deserialisation Vulnerability

CVSS 8.7 HIGHEPSS 0.9%CWE-502

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Jaspersoft · JasperReports IO At-Scale Jaspersoft · JasperReports IO Professional Jaspersoft · JasperReports Library Community Edition Jaspersoft · JasperReports Library Professional Jaspersoft · JasperReports Server Jaspersoft · JasperReports Web Studio Jaspersoft · Jaspersoft Studio Community Edition Jaspersoft · Jaspersoft Studio Professional

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition