CVE-2025-48734: Apache Commons BeanUtils Improper Access Control Vulnerability
Summary
CVE-2025-48734: Apache Commons Improper Access Control vulnerability. Affects commons-beanutils:commons-beanutils versions >= 1.0, < 1.11.0. Fixed in 1.11.0. How to fix ↓
Also tracked for
- commons-beanutils · Debian:11
The same CVE-2025-48734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons BeanUtils is a Java library that provides easy manipulation of JavaBeans properties. It allows developers to access and modify properties of Java objects dynamically. The library is widely used in Java applications for its convenience in handling property access and manipulation. However, it has been found to have an improper access control vulnerability that could allow attackers to exploit class loader access through Java enum properties.
Vulnerability Detail
The vulnerability arises from the improper access control in Apache Commons BeanUtils, specifically in how it handles Java enum properties. Introduced in version 1.9.2, a special BeanIntrospector class was designed to prevent attackers from accessing the class loader through the declared class property of Java enums. However, this protection was not enabled by default. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can exploit this to access the enum's class loader via the 'declaredClass' property. This access can lead to the execution of arbitrary code, posing a significant security risk.
How To Fix
Minimum fixed version
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to disable the new BeanIntrospector that suppresses the 'declaredClass' property. However, this is not recommended as it reintroduces the vulnerability. Instead, ensure that property paths are not directly passed from untrusted sources to the getProperty() method.
Conclusion
The Apache Commons BeanUtils vulnerability CVE-2025-48734 poses a significant security risk due to improper access control. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for commons-beanutils:commons-beanutils →
FAQ
CVE-2025-48734 is a vulnerability in Apache Commons BeanUtils that allows improper access control, potentially enabling attackers to execute arbitrary code.
Versions 1.x before 1.11.0 and 2.x before 2.0.0-M2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application's pom.xml at Vulert's playground without signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If immediate upgrading is not possible, avoid passing untrusted property paths to the getProperty() method as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for commons-beanutils:commons-beanutils.
