CVE-2025-58782: Apache Jackrabbit Vulnerability Exposes Systems to JNDI Injection and RCE

CVE-2025-58782 is a newly disclosed vulnerability in Apache Jackrabbit Core and JCR Commons that introduces a JNDI injection risk for versions 1.0.0 through 2.22.1, potentially enabling remote code execution through deserialization when JNDI URIs are used for JCR lookup from untrusted users.

According to the mailing list, “Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data.” The flaw stems from how JNDI URIs are handled during JCR repository lookups, with remote attackers able to trigger deserialization of untrusted data via a malicious JNDI reference.

The affected components are org.apache.jackrabbit:jackrabbit-core (1.0.0–2.22.1) and org.apache.jackrabbit:jackrabbit-jcr-commons (1.0.0–2.22.1), and exploitation could lead to arbitrary code execution, data exfiltration, or service disruption on Jackrabbit-based deployments exposed to untrusted JNDI lookups. Users are advised to upgrade to version 2.22.2, where JNDI lookups have been disabled by default and must be enabled explicitly, after reviewing use of JNDI URIs for JCR lookup.