Skip to content
Sign in
Not rated

CVE-2025-53689 Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an…

Description

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Affected products and versions

Product Affected versions Fixed in
Apache Jackrabbit 2.23 2.23.0-beta → < 2.23.2-beta 2.23.2-beta
Apache Jackrabbit 2.22 2.22.0 → < 2.22.1 2.22.1
Apache Jackrabbit 2.20 2.20.0 → < 2.20.17 2.20.17

Other CVEs of Apache Jackrabbit

The 3 CVEs of Apache Jackrabbit →
CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client 6.9 Medium CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit 9.3 Critical
Track this CVE