Class Selection Vulnerability in Apache Jackrabbit's WebDAV/Davex Client
CVE-2026-92415

6.9MEDIUM

Key Information:

Vendor

Apache
Status
Apache Jackrabbit
Vendor
CVE Published:
7 October 2026

What is CVE-2026-92415?

A vulnerability allows a malicious WebDAV/DavEx server or an attacker intercepting the connection to exploit the Apache Jackrabbit WebDAV/Davex client. This can lead to the instantiation of arbitrary classes from the classpath, resulting in potential arbitrary file creation or truncation. Applications directly utilizing jackrabbit-spi2dav to connect to remote repositories are at risk. Users are encouraged to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 to mitigate this vulnerability.

Affected Version(s)

Apache Jackrabbit 2.23.0 <= 2.23.5

Apache Jackrabbit 2.22.0 <= 2.22.4

Apache Jackrabbit 2.20.0 <= 2.20.17

References

https://lists.apache.org/thread.html/hcrxm4jp1mtk56xb8p1d...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Julian Reschke
Claude Security
.