CVE-2025-10492

Tuesday, September 16, 2025

8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Affected Software

Vendor	Product	Version Range	Status
Jaspersoft	JasperReports Library Community Edition	`0 <= 7.0.3`	affected
Jaspersoft	Jaspersoft Studio Community Edition	`0 <= 7.0.3`	affected
Jaspersoft	JasperReports Server	`0 <= 9.0.0`	affected
Jaspersoft	JasperReports Library Professional	`0 <= 9.0.2`	affected
Jaspersoft	Jaspersoft Studio Professional	`0 <= 9.0.2`	affected
Jaspersoft	JasperReports IO Professional	`0 <= 4.0.0`	affected
Jaspersoft	JasperReports IO At-Scale	`0 <= 4.0.0`	affected
Jaspersoft	JasperReports Web Studio	`0 <= 3.0.1`	affected

Weaknesses

CWE-502: CWE-502 Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

CVE Program Container

Additional References

https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition

References

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.