jaspersoft/jasperreports · Security
JasperReports has a Java deserialisation vulnerability
- GHSA ID
- GHSA-7c3f-cg9x-f3gr
- CVE ID
- CVE-2025-10492
- Severity
- high
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-10492 ↗
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 ↗
- https://github.com/Jaspersoft/jasperreports/issues/542 ↗
- https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition ↗
- https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 ↗
- https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 ↗
- https://github.com/advisories/GHSA-7c3f-cg9x-f3gr ↗