CVE-2026-17595
Received Received - Intake

Nexus Repository 3 JEXL Expression Property Disclosure

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Sonatype

Description
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-17595
EUVD
EUVD-2026-54519

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository From 3.15.0 (inc) to 3.94.x (inc)
sonatype nexus_repository to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nexus Repository 3 had a flaw where JEXL expressions in Content Selectors were not properly sandboxed. An attacker with the nexus:selectors:create permission could exploit this to read internal Java object properties, exposing JVM class metadata like class and classloader names. The issue did not allow method execution or code execution, limiting impact to information disclosure.

Detection Guidance

Check Nexus Repository version with 'curl -s http://localhost:8081/service/rest/v1/status/check | grep nexusVersion' or via admin UI. Verify if version is below 3.95.0. Inspect Content Selector expressions for suspicious JEXL syntax using admin logs or 'find /path/to/nexus -name "*.xml" -exec grep -l "jexl" {} \;'.

Impact Analysis

An attacker with the nexus:selectors:create permission could access sensitive internal JVM details, potentially aiding further attacks by revealing system information. The impact is limited to information disclosure and requires specific permissions.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of internal system information, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is exposed. Mitigation requires upgrading to version 3.95.0 or later.

Mitigation Strategies

Upgrade Nexus Repository to version 3.95.0 or later immediately. Review and restrict accounts with nexus:selectors:create permission. Monitor for unusual activity in Content Selector configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17595. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart