CVE-2025-10492

Jaspersoft Library Deserialisation Vulnerability

CVSS 8.7 HIGHEPSS 0.9%CWE-502

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Jaspersoft · JasperReports IO At-Scale Jaspersoft · JasperReports IO Professional Jaspersoft · JasperReports Library Community Edition Jaspersoft · JasperReports Library Professional Jaspersoft · JasperReports Server Jaspersoft · JasperReports Web Studio Jaspersoft · Jaspersoft Studio Community Edition Jaspersoft · Jaspersoft Studio Professional

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition