GHSA-jq2c-m8gg-mqcm

Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-49656

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.jena:jena-fuseki	< 5.5.0	5.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-49656 advisory
https://github.com/apache/jena/commit/03c5265910aa3a27907bf54f6b4aaae3409afa4f web
https://github.com/apache/jena/commit/35350569b4c1fd432d92e7c92af9597c4400debe web
https://github.com/apache/jena package
https://lists.apache.org/thread/qmm21som8zct813vx6dfd1phnfro6mwq web
http://www.openwall.com/lists/oss-security/2025/07/21/1 web