Apache Jackrabbit Vulnerability Exposes Systems to Remote Code Execution Attacks

A new security flaw has been discovered in Apache Jackrabbit, a widely used content repository system, potentially exposing thousands of applications to remote code execution risks. The vulnerability, tracked as CVE-2025-58782, affects both Apache Jackrabbit Core and Apache Jackrabbit JCR Commons, with severity rated as important.

The issue arises from deserialization of untrusted data within JNDI-based repository lookups, and attackers can exploit this by injecting malicious JNDI references when applications accept untrusted inputs for repository connections, potentially allowing remote execution of arbitrary code.

Marcel Reutegger, a core Apache Jackrabbit contributor, confirmed the flaw in a public advisory, and the Apache Software Foundation has recommended upgrading to version 2.22.2 where JNDI lookup is disabled by default; if upgrading is not possible, disabling JNDI lookups for JCR connections is advised. According to Apache Jackrabbit’s official website, the vulnerability has been assigned the internal bug tracking code JCR-5135, and quick action is urged to prevent exploitation.