CVE-2025-49656highCWE-22

CVE-2025-49656: high-severity vulnerability in Apache Jena

Apache Jena: Administrative users can create files outside the server directory space via the admin UI

Published · Updated

Follow this CVE+ Monitor Apache Jena+ Monitor apache-jena

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.6%
Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Apache Software Foundation · Apache Jena
Related CVEs — Apache Jena

In the same product, most dangerous first.

CVE-2021-39239—XML External Entity (XXE) vulnerabilityEPSS 4.3%CVE-2022-28890—Processing external DTDsEPSS 2.7%CVE-2023-32200HIGHApache Jena: Exposure of execution in script engine expressions.EPSS 1.5%CVE-2023-22665—Apache Jena: Exposure of arbitrary execution in script engine expressions.EPSS 1.3%CVE-2025-50151HIGHApache Jena: Configuration files uploaded by administrative users are not check properlyEPSS 1.1%