UBUNTU-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

org.apache.jackrabbit.vault:org.apache.jackrabbit.vault (4.0.0), org.apache.jackrabbit.vault:org.apache.jackrabbit.vault.rcp (4.0.0) +6 more potentially affected by CVE-2026-92415 via org.apache.jackrabbit:jackrabbit-spi2dav (>=2.22.0, <=2.22.4)

org.apache.jackrabbit:jackrabbit-spi2dav MAVEN version =2.22.0, =4.0.0, =2.22.0, =2.22.0, =2.22.4 - org.apache.sling:org.apache.sling.starter.integration-tests 14 Source cves: CVE-2026-92415 Source advisory: MEND:CVE-2026-92415...

org.apache.jackrabbit:jackrabbit-jcr2dav (>=2.23.0-beta, <=2.23.5-beta), org.apache.jackrabbit:jackrabbit-standalone-components (>=2.23.0-beta, <=2.23.5-beta) potentially affected by CVE-2026-92415 via org.apache.jackrabbit:jackrabbit-spi2dav (>=2.23.0-beta, <=2.23.5-beta)

org.apache.jackrabbit:jackrabbit-spi2dav MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.5-beta Source cves: CVE-2026-92415 Source advisory: MEND:CVE-2026-92415...

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

PT-2026-107580

Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.23.0 through 2.23.5 Apache Jackrabbit versions 2.22.0 through 2.22.4 Apache Jackrabbit versions 2.20.0 through 2.20.17 Description The WebDAV/DavEx client contains a flaw where it uses externally-controlled input t...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: OSV:GHSA-44C3-38H8-9FH9...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory:...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: GHSA-44C3-38H8-9FH9...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: MEND:CVE-2025-53689...

org.apache.archiva:archiva-webapp (>=1.4-m4, <=2.0.1), org.apache.archiva:archiva-webdav (>=1.4-m4, <=2.0.1) +13 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.6.0, <=2.6.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.6.0, =1.4-m4, =1.4-m4, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =1.2.2, =2.2.2, =1.3.0-beta3, =1.0.0-beta1, =1.2.0-cr9, =1.3.0-beta2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

org.apache.archiva:archiva-webapp (>=1.4-m4, <=2.0.1), org.apache.archiva:archiva-webdav (>=1.4-m4, <=2.0.1) +13 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.6.0, <=2.6.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.6.0, =1.4-m4, =1.4-m4, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =1.2.2, =2.2.2, =1.3.0-beta3, =1.0.0-beta1, =1.2.0-cr9, =1.3.0-beta2 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

org.apache.jackrabbit:jackrabbit-bundle (>=2.12.0, <=2.12.3), org.apache.jackrabbit:jackrabbit-jcr-server (>=2.12.0, <=2.12.3) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.12.0, <=2.12.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =1.3.2, =1.3.4 - org.apache.sling:org.apache.sling.jcr.webdav 2.3.4 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

net.oneandone.cosmo:cosmo-core (>=1.3.0, <=3.2.4), org.apache.jackrabbit:jackrabbit-bundle (>=2.13.0, <=2.13.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.13.0, <=2.13.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.13.0, =1.3.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.2 Source cves: CVE-2016-6801 Source advisory: GHSA-9FC7-RHQ3-WM7X...

com.khubla.com.pragmatach.examples:jcrexample (1.40), com.khubla.pragmatach:pragmatach-jcr (1.40) +15 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.8.0, <=2.8.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.8.0, =2.1.0, =2.1.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =1.0.9, =1.0, =0.9.5, =5.13.1, =5.13.1, =5.22.7 and more Source cves: CVE-2016-6801 Source advisory: MEND:CVE-2016-6801...

de.pfabulist.lindwurm:niodav (>=0.2.4, <=0.4.2), de.pfabulist.lindwurm:stellvertreter-app (0.5.2) +5 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.10.0, <=2.10.3)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.10.0, =0.2.4, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.3 Source cves: CVE-2016-6801 Source advisory: MEND:CVE-2016-6801...