CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2025-10492
High (8.7) in cloud. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in net.sf.jasperreports:jasperreports 7.0.4.
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cloud:jasperreports_io
- cloud:jasperreports_library
- cloud:jasperreports_server
- cloud:jasperreports_studio
- cloud:jasperreports_web_studio
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7c3f-cg9x-f3gr | Maven | net.sf.jasperreports:jasperreports | <7.0.4 | 7.0.4 |