CVE-2025-50151
Published: 21 July 2025
Summary
CVE-2025-50151 is a high-severity Improper Input Validation (CWE-20) vulnerability in Apache Jena. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-50151 is a vulnerability in Apache Jena versions up to and including 5.4.0, where file access paths specified in configuration files uploaded by users with administrator access are not properly validated. This flaw, classified under CWE-20 (Improper Input Validation), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
An attacker with administrator privileges on an affected Apache Jena deployment can exploit this issue over the network with low complexity and no user interaction required. By uploading a malicious configuration file containing arbitrary file access paths, the attacker can achieve high-impact outcomes, such as unauthorized access to sensitive files, modification of critical data, or disruption of services, leveraging the unvalidated paths to bypass intended restrictions.
The Apache security advisory recommends upgrading to Apache Jena version 5.5.0, which addresses the issue by disallowing arbitrary configuration uploads. Additional details are available in the official Apache announcement at https://lists.apache.org/thread/12gks5z40gh9bszn1xk8mz34gz586xss and the OSS-Security mailing list post at http://www.openwall.com/lists/oss-security/2025/07/21/2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22072
Vulnerability details
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables authenticated admin to upload configs with unvalidated paths for arbitrary file read/write on exposed Jena server (T1190); directly facilitates unauthorized local file access (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs for consistency with anticipated content, directly mitigating the improper validation of file access paths in administrator-uploaded configuration files.
SI-2 mandates timely flaw remediation, such as patching Apache Jena to version 5.5.0 which disallows arbitrary configuration uploads exploiting unvalidated paths.
SI-9 enforces restrictions on information inputs, preventing arbitrary or malicious file access paths in uploaded configuration files by limiting to organization-defined safe inputs.