Cyber Posture

CVE-2025-50151

High

Published: 21 July 2025

Published
21 July 2025
Modified
04 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 53.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50151 is a high-severity Improper Input Validation (CWE-20) vulnerability in Apache Jena. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validation of information inputs for consistency with anticipated content, directly mitigating the improper validation of file access paths in administrator-uploaded configuration files.

prevent

SI-2 mandates timely flaw remediation, such as patching Apache Jena to version 5.5.0 which disallows arbitrary configuration uploads exploiting unvalidated paths.

prevent

SI-9 enforces restrictions on information inputs, preventing arbitrary or malicious file access paths in uploaded configuration files by limiting to organization-defined safe inputs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Vuln enables authenticated admin to upload configs with unvalidated paths for arbitrary file read/write on exposed Jena server (T1190); directly facilitates unauthorized local file access (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.

Deeper analysisAI

CVE-2025-50151 is a vulnerability in Apache Jena versions up to and including 5.4.0, where file access paths specified in configuration files uploaded by users with administrator access are not properly validated. This flaw, classified under CWE-20 (Improper Input Validation), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

An attacker with administrator privileges on an affected Apache Jena deployment can exploit this issue over the network with low complexity and no user interaction required. By uploading a malicious configuration file containing arbitrary file access paths, the attacker can achieve high-impact outcomes, such as unauthorized access to sensitive files, modification of critical data, or disruption of services, leveraging the unvalidated paths to bypass intended restrictions.

The Apache security advisory recommends upgrading to Apache Jena version 5.5.0, which addresses the issue by disallowing arbitrary configuration uploads. Additional details are available in the official Apache announcement at https://lists.apache.org/thread/12gks5z40gh9bszn1xk8mz34gz586xss and the OSS-Security mailing list post at http://www.openwall.com/lists/oss-security/2025/07/21/2.

Details

CWE(s)

Affected Products

apache
jena
≤ 5.5.0

CVEs Like This One

CVE-2026-22444Same vendor: Apache
CVE-2025-48913Same vendor: Apache
CVE-2025-29847Same vendor: Apache
CVE-2026-24734Same vendor: Apache
CVE-2025-66518Same vendor: Apache
CVE-2025-68493Same vendor: Apache
CVE-2026-24308Same vendor: Apache
CVE-2025-66614Same vendor: Apache
CVE-2026-34197Same vendor: Apache
CVE-2025-23195Same vendor: Apache

References