CVE-2026-92415

published 2026-10-07

CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an…

Priority P3 35 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client.

A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.

Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.

Category: unsafe reflection on wire data (HIGH).

This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.

Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	jackrabbit	>= 2.20.0 < 2.20.18	2.20.18
apache	jackrabbit	>= 2.22.0 < 2.22.5	2.22.5
apache	jackrabbit	>= 2.23.0 < 2.23.6	2.23.6
apache_software_foundation	apache_jackrabbit	2.20.0 – 2.20.17	—
apache_software_foundation	apache_jackrabbit	2.22.0 – 2.22.4	—
apache_software_foundation	apache_jackrabbit	2.23.0 – 2.23.5	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd v4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-470