CVE-2025-49656: Apache Jena Fuseki Allows Database File Creation Outside Designated Area
Summary
CVE-2025-49656: Users with administrator access can create databases files outside the files area of the Fuseki server. Affects org.apache.jena:jena-fuseki versions < 5.5.0. Fixed in 5.5.0. How to fix ↓
Also tracked for
- apache-jena · Debian:12
The same CVE-2025-49656 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Jena Fuseki is a robust server for serving RDF data and SPARQL queries. It enables users to create, manage, and query RDF datasets over the web. The server is designed for flexibility and scalability, making it a popular choice for applications that require semantic web technologies. However, it has been identified that versions up to 5.4.0 have a vulnerability that allows users with administrative access to create database files outside the designated files area, posing a security risk.
Vulnerability Detail
The vulnerability arises from improper access controls that permit users with administrator privileges to create database files in locations outside the intended file area of the Fuseki server. This could lead to unauthorized access to sensitive data or system files, potentially compromising the integrity and confidentiality of the server. The issue is classified under CWE-22, which pertains to improper restriction of a pathname reference. The severity of this vulnerability is rated as moderate, with a CVSS score of 4.9.
How To Fix
Latest published version: 6.2.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict administrative access to trusted users only, and monitor file creation activities closely until the upgrade can be performed.
Conclusion
In summary, the vulnerability identified as CVE-2025-49656 in Apache Jena Fuseki allows users with administrative access to create database files outside the designated area, posing a security risk. Users are strongly advised to upgrade to version 5.5.0 or later to mitigate this issue.
See every vulnerability recorded for org.apache.jena:jena-fuseki →
FAQ
The vulnerability allows users with administrative access to create database files outside the designated area, which could lead to unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Apache Jena Fuseki up to 5.4.0 are affected by this vulnerability.
If an immediate upgrade is not possible, restrict administrative access and monitor file creation activities closely as a temporary measure.
The CVSS score for this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jena:jena-fuseki.
