Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's…

Risk score
41/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.5%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation …
Affected
Apache Jackrabbit before 2.23.6, 2.22.5, 2.20.18
Fix
Upgrade Apache Jackrabbit to 2.23.6, 2.22.5 or 2.20.18 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache JackrabbitTHE FLAWSTHE FIXCVE-2026-92415— Use of Externally-ControlledInput to Select Classes orCode vulnerability in Apache…CVSS 5.3 · EPSS 1%CVE-2026-92414: Session Fixation / SessionReuse across Usersvulnerability in Apache…CVSS 9.1 · EPSS 1%Upgrade Apache Jackrabbit2.23.6 · 2.22.5 · 2.20.18or later on your release lineWho is exposedApache Jackrabbit before2.23.6, 2.22.5, 2.20.18AMBER · PATCH THIS WEEKApache Jackrabbit: Session Fixation / SessionReuse across Users vulnerabilityin Apache Jackrabbit. JackrabbitWebDAV server attaches acached authenticated session onanyLock-Token/TransactionId/Sub…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-470 (CWE-470)26 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Jackrabbit: Amber, patch this week. : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, fro…

The flaws

  • CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit… (CVSS 9.1 · EPSS 1%)

The fix

Upgrade Apache Jackrabbit: 2.23.6 · 2.22.5 · 2.20.18 or later on your release line

Who is exposed: Apache Jackrabbit before 2.23.6, 2.22.5, 2.20.18

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium

References

Original description

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Last activity 7 Oct 2026. Patch Forecast updates every hour.