PT-2025-54691 · Maven · Net.Sf.Jasperreports:Jasperreports

Published 2025-09-16 · Updated 2025-09-16

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-7C3F-CG9X-F3GR

Affected Products

Net.Sf.Jasperreports:Jasperreports

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10492 · Security Note
• https://osv.dev/vulnerability/GHSA-7c3f-cg9x-f3gr · Vendor Advisory
• https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 · Note
• https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 · Note
• https://github.com/Jaspersoft/jasperreports/issues/542 · Note
• https://github.com/Jaspersoft/jasperreports · Note
• https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition · Note
• https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 · Note