Package · Ubuntu

jackrabbit

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

Medium 6.9

CVE-2026-92415

Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr…

Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu

Oct 7, 2026
Critical 9.3

CVE-2026-92414 Public exploit

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…

Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu

Oct 7, 2026
Medium 6.5

CVE-2025-58782

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accep…

Apache Software Foundation Apache Jackrabbit JCR Commons Apache Jackrabbit Core jackrabbit Debian Ubuntu Maven

Sep 8, 2025
High 8.8

CVE-2025-53689

Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Ja…

Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu Maven

Jul 14, 2025
Critical 9.8

CVE-2023-37895

Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which co…

Apache Software Foundation Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) Apache Jackrabbit Webapp (jackrabbit-webapp) jackrabbit Debian Ubuntu Maven

Jul 25, 2023
High 8.8

CVE-2016-6801

Apache Jackrabbit Authentication Hijacking Vulnerability

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows re…

jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-webdav Debian Ubuntu Maven

Sep 21, 2016
Medium —

CVE-2015-1833 Public exploit EPSS 56%

Improper Input Validation in Apache Jackrabbit

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet …

jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-core Debian Ubuntu Maven

May 29, 2015