Listen to this Post
How the CVE Works
CVE-2025-49656 is a directory traversal vulnerability in Apache Jena Fuseki (up to v5.4.0). Administrators can exploit improper path validation to create database files outside the server’s designated file area. This occurs when user-supplied input is not sanitized, allowing attackers to manipulate paths using `../` sequences. The flaw enables unauthorized file system access, potentially leading to remote code execution (RCE) or data exfiltration. The vulnerability leverages Fuseki’s database management API, where crafted requests bypass directory restrictions.
DailyCVE Form
Platform: Apache Jena Fuseki
Version: ≤ 5.4.0
Vulnerability: Directory Traversal
Severity: Critical
Date: 07/29/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Check Fuseki version curl -X GET http://localhost:3030/$/server Exploit PoC (sanitized) curl -X POST --path-as-is "http://target:3030/$/datasets?dbname=../../malicious"
How Exploit
1. Authenticate as admin.
2. Craft malicious path traversal request.
3. Write files outside restricted directories.
Protection from this CVE
- Upgrade to v5.5.0.
- Restrict admin access.
- Implement path sanitization.
Impact
- Unauthorized file writes.
- Remote code execution.
- Data compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
