Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

CVE-2025-58782 is a deserialization of untrusted data vulnerability in Apache Jackrabbit Core and JCR Commons, affecting versions 1.0.0 through 2.22.1 [1]. The root cause is that JndiRepositoryFactory accepts JNDI URIs without proper validation, allowing injection of malicious references [4].

An attacker can exploit this by providing a crafted JNDI URI to a vulnerable application, which when processed leads to deserialization of attacker-controlled data [1]. This can result in arbitrary code execution on the server [4]. The attack requires the application to accept JNDI URIs from untrusted users [1].

The impact is critical, as successful exploitation allows remote code execution, compromising the confidentiality, integrity, and availability of the system [1].

The vulnerability is fixed in version 2.22.2, where JNDI lookup is disabled by default [2]. Users are advised to upgrade immediately and, if JNDI lookup is required, to enable it explicitly and review their use of JNDI URIs [3].