Deserialization Vulnerability in Apache Jackrabbit Core and JCR Commons

CVE-2025-58782

What is CVE-2025-58782?

A deserialization of untrusted data vulnerability exists in both Apache Jackrabbit Core and JCR Commons, affecting versions from 1.0.0 through 2.22.1. Deployments that process JNDI URIs for JCR lookup from untrusted users are susceptible to malicious JNDI references. This security flaw can enable attackers to execute arbitrary code through unsafe data deserialization. Users are advised to upgrade to version 2.22.2, where JNDI lookup capability has been disabled by default. Users leveraging this feature are encouraged to assess their use of JNDI URIs for JCR lookup.

References