cbcvebase.
CVE-2025-50151
published 2025-07-21

CVE-2025-50151: File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0…

PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.94%
56.7th percentile
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.

Affected

9 ranges
VendorProductVersion rangeFixed in
apachejena< 5.5.05.5.0
apache_software_foundationapache_jena<= 5.4.0
debianapache-jena
msrcazl3_kernel_6.6.57.1-7_on_azure_linux_3.0
msrcazl3_kernel_6.6.64.2-1_on_azure_linux_3.0
msrccbl2_kernel_5.15.167.1-2_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.173.1-1_on_cbl_mariner_2.0
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerable versions of Apache Jena are up to and including 5.4.0; flag deployments running these versions where administrator-level configuration upload is possible
  • The vulnerability is exploited via uploading configuration files with unvalidated file access paths; monitor for unexpected or arbitrary configuration file uploads by administrator-privileged accounts in Apache Jena
  • ·Exploitation requires administrator-level access; this is not an unauthenticated attack vector
  • ·Fix is available in Apache Jena 5.5.0, which removes the ability to perform arbitrary configuration upload entirely
  • ·Multiple Red Hat products (AMQ Clients, Apicurio Registry 3, Data Grid 8, JBoss EAP 7/8/Expansion Pack, Streams for Apache Kafka 2) carry affected Jena packages with fixes currently deferred
  • ·Debian distributions (bookworm, forky, sid, trixie) remain open/unpatched as of advisory publication

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.