JVN#90566559: Apache Jena Fuseki vulnerable to path traversal

Jena Fuseki provided by The Apache Software Foundation contains the following vulnerability. Path traversal CWE-22 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Base Score 2.7 CVE-2025-49656 Impact A remore...

Apache Jena Path Traversal Vulnerability

Apache Jena is the Apache Software Foundation's Semantic Web framework for building and processing RDF data. A path traversal vulnerability exists in Apache Jena 5.4.0 and earlier versions, which originates from a user with administrator privileges being able to create database files outside of t...

org.graphity:core (>=1.1.1 <=1.1.3), org.rdfhdt:hdt-fuseki (=1.1) +6 more potentially affected by CVE-2025-49656 via org.apache.jena:jena-fuseki (>=1.0.0 <=1.1.0)

org.apache.jena:jena-fuseki MAVEN version =1.0.0, =1.1.1, =0.7, =0.7, =0.7, =0.7, =0.7, =0.7, =0.7.1 Source cves: CVE-2025-49656 Source advisory: OSV:GHSA-JQ2C-M8GG-MQCM...

io.telicent.smart-caches.graph:docker (>=0.82.10 <=0.83.11), io.telicent.smart-caches.graph:scg-system (>=0.82.10 <=0.83.11) +1 more potentially affected by CVE-2025-49656 via org.apache.jena:jena-fuseki-webapp (>=5.0.0-rc1 <=5.4.0)

org.apache.jena:jena-fuseki-webapp MAVEN version =5.0.0-rc1, =0.82.10, =0.82.10, =5.0.0, =5.4.0 Source cves: CVE-2025-49656 Source advisory: SNYK:JAVA-ORGAPACHEJENA-10874850...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the configuration file upload process. An attacker with administrative privileges could create datasets with arbitrary names and locations, causing unintended behavior and potentially causing a denial of...

Directory Traversal

Overview org.apache.jena:jena-fuseki-webapp is a Fuseki is a SPARQL 1.1 Server which provides the SPARQL query, SPARQL update and SPARQL graph store protocols. Affected versions of this package are vulnerable to Directory Traversal via the Fuseki Web UI. An attacker can create files outside the...

GHSA-JQ2C-M8GG-MQCM Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

io.github.sparql-anything:sparql-anything-fuseki (>=v1.0-DEV.3 <=v1.0.0), io.telicent.jena.graphql:graphql-fuseki-module (>=0.6.0 <=0.10.4) +12 more potentially affected by CVE-2025-50151 via org.apache.jena:jena-fuseki-main (>=5.0.0-rc1 <=5.4.0)

org.apache.jena:jena-fuseki-main MAVEN version =5.0.0-rc1, =v1.0-DEV.3, =0.6.0, =1.3.2, =0.72.1, =0.71.2, =0.71.2, =1.0.0, =0.80.0, =0.80.0, =1.2.0, =5.0.0, =5.0.0, =5.4.0 - zone.cogni.semanticz:semanticz-connector-fuseki =2.0.0 - zone.cogni.semanticz:semanticz-connectors-spring =2.0.0 Source cve...

CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

DEBIAN-CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

UBUNTU-CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

CVE-2025-49656

CVE-2025-49656 affects Apache Jena Fuseki prior to 5.5.0. Multiple connected sources describe a path traversal vulnerability where a user with administrator access can cause the Fuseki server to create database files outside the intended files area. The vulnerability is tied to the Fuseki admin/U...

PT-2025-30257 · Apache +1 · Fuseki +2

Name of the Vulnerable Software and Affected Versions: Apache Jena versions prior to 5.5.0 Description: Users with administrator access can create database files outside the designated files area of the Fuseki server. Recommendations: Upgrade to version 5.5.0...

Apache Jena 安全漏洞

Apache Jena is the Apache Software Foundation's Semantic Web framework for building and processing RDF data. A path traversal vulnerability exists in Apache Jena 5.4.0 and earlier versions, which originates from a user with administrator privileges being able to create database files outside of t...

CVE-2021-33192

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 inclusive...

GHSA-PHWJ-86VX-CFJC Cross-site scripting in Apache Jena Fuseki

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 inclusive...

Cross-site scripting in Apache Jena Fuseki

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 inclusive...

Apache Jena Fuseki Cross-Site Scripting Vulnerability

Apache Jena Fuseki is a SPARQL server from the Apache Foundation USA. It can run as an operating system service, as a Java Web application WAR file, and as a standalone server. A cross-site scripting vulnerability exists in Apache Jena Fuseki versions 2.0.0 through 4.0.0, which can be exploited b...

DEBIAN-CVE-2021-33192

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 inclusive...