Apache Jena (Apache Software Foundation) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2025-07-21. Vendor: Apache Software Foundation.

CVEs of Apache Jena

• CVE-2025-50151 - CVSS 8.8 (high), 2025-07-21: File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0.…
• CVE-2025-49656 - CVSS 7.5 (high), 2025-07-21: Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0.…
• CVE-2023-32200 - CVSS 8.8 (high), 2023-07-12: There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a…
• CVE-2023-22665 - CVSS 5.4 (medium), 2023-04-25: There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute…
• CVE-2022-28890 - CVSS 9.8 (critical), 2022-05-05: A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0…
• CVE-2021-39239 - CVSS 7.5 (high), 2021-09-16: A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing…