PT-2025-30258 · Apache+1 · Apache Jena+1

Andy Seaborne · Published 2025-07-21 · Updated 2025-07-29 · CVE-2025-50151

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jena versions up to 5.4.0

Description The application does not validate file access paths within configuration files uploaded by users possessing administrator privileges. This could allow for unauthorized access or manipulation of system resources.

Recommendations Upgrade to version 5.5.0, which prevents arbitrary configuration uploads.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-50151

GHSA-XG9P-P463-3QJP

Affected Products

Apache Jena

Debian

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-50151 · Vendor Advisory
• https://lists.apache.org/thread/12gks5z40gh9bszn1xk8mz34gz586xss · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xg9p-p463-3qjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50151 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-50151 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50151 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-50151 · Security Note
• https://ubuntu.com/security/CVE-2025-50151 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-50151 · Vendor Advisory
• https://github.com/apache/jena · Note
• https://twitter.com/dailycve/status/1950271655659360576 · Twitter Post
• https://twitter.com/CVEnew/status/1947232866489803073 · Twitter Post
• https://twitter.com/oss_security/status/1947745449470841203 · Twitter Post
• http://openwall.com/lists/oss-security/2025/07/21/2 · Note
• https://twitter.com/the_yellow_fall/status/1947476667087392876 · Twitter Post