4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49656

CVE-2025-49656: Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Users with administrator access can create databases files outside the files area of the Fuseki server.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49656

CVE-2025-49656:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.jena:jena-fuseki	maven	< 5.5.0	5.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue (CWE-22) in Apache Jena's Fuseki server. The root cause is insufficient input validation on the dbName parameter during dataset creation. An administrator user could exploit this to create database files in arbitrary locations on the server's filesystem.

The analysis of the provided patches clearly points to the org.apache.jena.fuseki.mgt.ActionDatasets.execPostContainer method as the vulnerable function. The patch in commit 03c5265910aa3a27907bf54f6b4aaae3409afa4f introduces two new validation methods, isValidServiceName and isValidTDBLocation, and integrates them into the execPostContainer method. These new checks effectively prevent the use of path traversal sequences like ../ in the dataset name and TDB location.

The second commit, 35350569b4c1fd432d92e7c92af9597c4400debe, appears to be part of a larger refactoring where the ActionDatasets class was moved from the jena-fuseki-webapp module to the jena-fuseki-main module. The security patch was carried over in this refactoring. Therefore, the core vulnerability and its fix are encapsulated within the changes to the execPostContainer method.

Any runtime monitoring or profiling tool would show org.apache.jena.fuseki.mgt.ActionDatasets.execPostContainer in the stack trace when a new dataset is being created. An exploit attempt would involve a POST request to the dataset management endpoint with a crafted dbName parameter, which would be processed by this function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.