Apache Jackrabbit Unsafe Reflection via WebDAV Client 2.202.23
CVE-2026-92415 Published on October 7, 2026
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client.
A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.
Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.
Category: unsafe reflection on wire data (HIGH).
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.
Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Vulnerability Analysis
CVE-2026-92415 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Reflection Injection Vulnerability?
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.
CVE-2026-92415 has been classified to as a Reflection Injection vulnerability or weakness.
Products Associated with CVE-2026-92415
Want to know whenever a new CVE is published for Apache Jackrabbit? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Jackrabbit:- Version 2.23.0, <= 2.23.5 is affected.
- Version 2.22.0, <= 2.22.4 is affected.
- Version 2.20.0, <= 2.20.17 is affected.