GitHub Advisoryadvisory · Maven
GHSA-jq2c-m8gg-mqcm Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server
MEDIUM
Official page ↗
- Aliases
- CVE-2025-49656
- Ecosystem
- Maven
- Packages
- org.apache.jena:jena-fuseki
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2025-07-21
Affected packages
• Maven org.apache.jena:jena-fuseki: < 5.5.0 → fixed in 5.5.0
Description
Users with administrator access can create databases files outside the files area of the Fuseki server.
This issue affects Apache Jena version up to 5.4.0.
Users are recommended to upgrade to version 5.5.0, which fixes the issue.
Related
Alias · CVE (1)
- CVE-2025-49656 Users with administrator access can create databases files outside the files area of the Fuseki server. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-49656 advisory
- https://github.com/apache/jena/commit/03c5265910aa3a27907bf54f6b4aaae3409afa4f web
- https://github.com/apache/jena/commit/35350569b4c1fd432d92e7c92af9597c4400debe web
- https://github.com/apache/jena package
- https://lists.apache.org/thread/qmm21som8zct813vx6dfd1phnfro6mwq web
- http://www.openwall.com/lists/oss-security/2025/07/21/1 web