CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
Attackers can achieve arbitrary code execution via JNDI injection if JCR lookup from untrusted users is enabled, requiring an upgrade to disable this feature by default.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58782?
CVE-2025-58782 is a medium-severity unsafe deserialization vulnerability in Apache Jackrabbit Core, published on 8 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.
This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.
Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
Weakness: CWE-502
Which versions are affected by CVE-2025-58782?
4 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-core and org.apache.jackrabbit:jackrabbit-jcr-commons. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.jackrabbit:jackrabbit-core Maven | From 1.0.0 | 2.22.2 |
org.apache.jackrabbit:jackrabbit-core Maven | From 1.0.0 | 2.22.2 |
org.apache.jackrabbit:jackrabbit-jcr-commons Maven | From 1.0.0 | 2.22.2 |
org.apache.jackrabbit:jackrabbit-jcr-commons Maven | From 1.0.0 | 2.22.2 |
Products include Apache Jackrabbit.
How do I fix CVE-2025-58782?
Upgrade org.apache.jackrabbit:jackrabbit-core to 2.22.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-58782 being exploited?
There is no known exploitation of CVE-2025-58782 in the wild and no public exploit code.
Other vulnerabilities in Apache Jackrabbit Core
- CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE
- CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
- CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
- CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability
- CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
Sources
Also known as DEBIAN-CVE-2025-58782, GHSA-cxvc-g8f2-4gmm, UBUNTU-CVE-2025-58782.