critical9.8
CVE-2025-10492
JasperReports has a Java deserialisation vulnerability
Impact
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.sf.jasperreports:jasperreports | < 7.0.4 | 7.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloud | Jasperreports Io | through 4.0.0 |
| Cloud | Jasperreports Library | through 7.0.3 through 9.0.2 |
| Cloud | Jasperreports Server | through 9.0.0 |
| Cloud | Jasperreports Studio | through 7.0.3 through 9.0.2 |
| Cloud | Jasperreports Web Studio | through 3.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/
- https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition
- https://github.com/advisories/GHSA-7c3f-cg9x-f3gr
- https://nvd.nist.gov/vuln/detail/CVE-2025-10492
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6
- https://github.com/Jaspersoft/jasperreports/issues/542
- https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647
- https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569