Apache Jena: Configuration files uploaded by administrative users are not check properly

Vulnerability

Description

CVE-2025-50151 is a vulnerability in Apache Jena versions up to 5.4.0 where file access paths specified in configuration files uploaded by users with administrator access are not validated. This means that an administrator can include arbitrary file paths in the configuration, potentially accessing files outside of the intended scope [1][3].

Exploitation

Exploitation requires administrative privileges, as only users with administrator access can upload configuration files. The attacker can craft a configuration file that references file paths, which the system will process without proper validation, leading to unauthorized file access [3].

Impact

An attacker with administrative access could exploit this to read sensitive files on the server, such as application secrets, source code, or other data, depending on the file system permissions. The exact impact is limited by the privileges of the Jena process [1].

Mitigation

Users are recommended to upgrade to Apache Jena version 5.5.0, which does not allow arbitrary configuration upload, effectively closing this attack vector. No other workarounds are mentioned [1][3].