GHSA-7c3f-cg9x-f3gr

JasperReports has a Java deserialisation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-10492

Packages

Ecosystem	Package	Affected	Fixed in
Maven	net.sf.jasperreports:jasperreports	< 7.0.4	7.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-10492 advisory
https://github.com/Jaspersoft/jasperreports/issues/542 web
https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 web
https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 web
https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 web
https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition web
https://github.com/Jaspersoft/jasperreports package