GHSA-7c3f-cg9x-f3gr
JasperReports has a Java deserialisation vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2025-10492
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
Affected packages
| Package | Versions |
|---|---|
| Maven · net.sf.jasperreports:jasperreports | introduced 0, fixed 7.0.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-10492 ADVISORY
- https://github.com/Jaspersoft/jasperreports/issues/542 WEB
- https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 WEB
- https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 WEB
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 WEB
- https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition WEB
- https://github.com/Jaspersoft/jasperreports PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |