ZDI-25-948: Jaspersoft Jasper Reports JRLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Jaspersoft Jasper Reports. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2025-10492.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-948?
The severity of ZDI-25-948 is critical due to the potential for remote code execution.
How do I fix ZDI-25-948?
To fix ZDI-25-948, you should update your installation of TIBCO Jaspersoft Jasper Reports to the latest version that addresses this vulnerability.
Which versions of Jaspersoft Jasper Reports are affected by ZDI-25-948?
ZDI-25-948 affects specific versions of TIBCO Jaspersoft Jasper Reports that are susceptible to remote code execution.
Who is impacted by ZDI-25-948?
Organizations using affected versions of TIBCO Jaspersoft Jasper Reports are at risk due to the ZDI-25-948 vulnerability.
What is the exploit method for ZDI-25-948?
The exploit method for ZDI-25-948 involves remote attack vectors requiring interaction with the Jaspersoft Jasper Reports library.