CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client.
A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.
Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.
Category: unsafe reflection on wire data (HIGH).
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Jackrabbitto a version that resolves this vulnerability.Fixed in 2.23.6 - Upgrade
Upgrade
Apache Jackrabbitto a version that resolves this vulnerability.Fixed in 2.22.5 - Upgrade
Upgrade
Apache Jackrabbitto a version that resolves this vulnerability.Fixed in 2.20.18
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Only applications that use jackrabbit-spi2dav, either directly or through jackrabbit-jcr2dav, to connect to a remote repository are affected. Apache Jackrabbit servers are not affected.
What does an attacker need to exploit this issue?
An attacker must control a malicious WebDAV/DavEx server or be able to intercept the connection between the affected client application and its remote repository. No privileges or user interaction are indicated by the supplied CVSS vector.
What could exploitation do?
The attacker can cause the client to instantiate arbitrary classes from its classpath through server-controlled error bodies. This can lead to arbitrary file creation or truncation.
Which versions should be upgraded?
Affected versions are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17. Upgrade to 2.23.6, 2.22.5, or 2.20.18, respectively.