by Kastro
Paper/Archive/CVE-2025-10492

CVE-2025-10492

Jaspersoft JasperReports Library Community Edition — Jaspersoft Library Deserialisation Vulnerability

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.4.604 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Affected

ProductAffectedFixed inSource
JasperReports Library Community Edition≤ 7.0.3–CNA
Jaspersoft Studio Community Edition≤ 7.0.3–CNA
JasperReports Server≤ 9.0.0–CNA
JasperReports Library Professional≤ 9.0.2–CNA
Jaspersoft Studio Professional≤ 9.0.2–CNA
JasperReports IO Professional≤ 4.0.0–CNA
JasperReports IO At-Scale≤ 4.0.0–CNA
JasperReports Web Studio≤ 3.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Jaspersoft (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6refcommunity.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition