CVE-2026-92415
Received Received - Intake

Unsafe Reflection in Apache Jackrabbit WebDAV Client

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Apache Software Foundation

Description
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-92415
EUVD
EUVD-2026-94407

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Jackrabbit 2.23.0
Apache Software Foundation Apache Jackrabbit 2.22.0
Apache Software Foundation Apache Jackrabbit 2.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Jackrabbit allows a malicious WebDAV/DavEx server or an attacker intercepting the connection to force the client to load arbitrary classes from its classpath. This can result in arbitrary file creation or truncation on the affected system.

Detection Guidance

To detect this vulnerability, check if your system uses jackrabbit-spi2dav or jackrabbit-jcr2dav libraries. Inspect application dependencies for versions 2.23.0-2.23.5, 2.22.0-2.22.4, or 2.20.0-2.20.17. Monitor network traffic for WebDAV/DavEx connections to untrusted servers.

Impact Analysis

If you use jackrabbit-spi2dav or jackrabbit-jcr2dav to connect to a remote repository, an attacker could exploit this to create or delete files on your system. This could lead to data loss, unauthorized access, or system compromise depending on the attacker's goals.

Compliance Impact

The vulnerability allows arbitrary class instantiation and file manipulation via unsafe reflection, which could lead to unauthorized data access, modification, or deletion. This could violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Apache Jackrabbit to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue. Only applications using jackrabbit-spi2dav to connect to remote repositories are affected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart