Listen to this Post
Apache Jena’s Fuseki server suffers from a path traversal vulnerability (CVE-2025-XXXX) where authenticated administrators can create database files outside the intended directory. The flaw arises due to insufficient validation of user-supplied paths when handling database creation requests. When an admin submits a malicious path containing directory traversal sequences (e.g., ../), Fuseki fails to sanitize the input, allowing arbitrary file write outside the designated `files` area. This could lead to unauthorized file system modifications, server compromise, or data leakage. The vulnerability affects versions up to 5.4.0 and is fixed in 5.5.0.
DailyCVE Form:
Platform: Apache Jena
Version: ≤ 5.4.0
Vulnerability: Path Traversal
Severity: Moderate
Date: Jul 21, 2025
Prediction: Patch by Aug 2025
What Undercode Say:
Check Fuseki server version curl -I http://localhost:3030/$/server Exploit PoC (simulated) POST /$/datasets?dbName=../../malicious.db Mitigation test grep -r "PathSanitizer" /opt/fuseki/
How Exploit:
- Authenticate as admin.
- Craft a dataset creation request with `../` sequences.
- Server writes files outside restricted directory.
Protection from this CVE:
- Upgrade to Jena 5.5.0.
- Restrict admin privileges.
- Implement path sanitization.
Impact:
- Unauthorized file writes.
- Potential RCE or data loss.
- Server integrity compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
