Bug 2382279 (CVE-2025-50151)

Summary:	CVE-2025-50151 org.apache.jena: Apache Jena insufficent file validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, ataylor, bbaranow, bmaxwell, brian.stansberry, chfoley, darran.lofthouse, dkreling, dosoudil, eric.wittmann, istudens, ivassile, iweiss, janstey, mosmerov, msochure, msvehla, nipatil, nwallace, pantinor, pesilva, pjindal, pmackay, rkubis, rstancel, smaestri, swoodman, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A file path validation flaw has been discovered in Apache Jena. This flaw allows users with administrative access to upload arbitrary configurations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-21 10:01:18 UTC

File access paths in configuration files uploaded by users with administrator access are not validated.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.