CVE-2025-53689highCWE-611

CVE-2025-53689: high-severity vulnerability in Apache Jackrabbit

Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Published · Updated

Follow this CVE+ Monitor Apache Jackrabbit+ Monitor jackrabbit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Jackrabbit
Related CVEs — Apache Jackrabbit

In the same product, most dangerous first.

CVE-2026-92414CRITICALApache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensEPSS 0.7%CVE-2026-92415MEDIUMApache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesEPSS 0.5%