GitHub Advisoryadvisory · Maven
GHSA-7c3f-cg9x-f3gr JasperReports has a Java deserialisation vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2025-10492
- Ecosystem
- Maven
- Packages
- net.sf.jasperreports:jasperreports
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2026-01-09
Affected packages
• Maven net.sf.jasperreports:jasperreports: < 7.0.4 → fixed in 7.0.4
Description
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
Related
Alias · CVE (1)
- CVE-2025-10492 A Java deserialisation vulnerability has been discovered in Jaspersoft Library. vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-10492 advisory
- https://github.com/Jaspersoft/jasperreports/issues/542 web
- https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 web
- https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 web
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 web
- https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition web
- https://github.com/Jaspersoft/jasperreports package