CVE-2025-49656

Published: Jul 21, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue.

Affected (1)

Products: Apache: Jena

Apache

1 product

Jena

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Jena	Before 5.5.0

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://lists.apache.org/thread/qmm21som8zct813vx6dfd1phnfro6mwq

Source: security@apache.org

Issue TrackingVendor Advisory

http://www.openwall.com/lists/oss-security/2025/07/21/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.