PT-2025-30257 · Apache+1 · Fuseki+2

Noriaki Iwasaki · Published 2025-07-21 · Updated 2025-07-22 · CVE-2025-49656

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Jena versions prior to 5.5.0

Description Users with administrator access can create database files outside the designated files area of the Fuseki server.

Recommendations Upgrade to version 5.5.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-49656

GHSA-JQ2C-M8GG-MQCM

Affected Products

Apache Jena

Debian

Fuseki

References · 18

• https://security-tracker.debian.org/tracker/CVE-2025-49656 · Vendor Advisory
• https://lists.apache.org/thread/qmm21som8zct813vx6dfd1phnfro6mwq · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49656 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-49656 · Security Note
• https://osv.dev/vulnerability/GHSA-jq2c-m8gg-mqcm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49656 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49656 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49656 · Vendor Advisory
• https://github.com/apache/jena/commit/03c5265910aa3a27907bf54f6b4aaae3409afa4f · Note
• https://github.com/apache/jena · Note
• https://github.com/apache/jena/commit/35350569b4c1fd432d92e7c92af9597c4400debe · Note
• https://twitter.com/oss_security/status/1947745449470841203 · Twitter Post
• https://t.me/pentestingnews/64893 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1947476667087392876 · Twitter Post