Deserialization in Cloud Jasperreports_io
CVE-2025-10492
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Vulnerability class: Insecure Deserialization
EPSS: 0.009 (55.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cloud Jasperreports_io
- Cloud Jasperreports_library
- Cloud Jasperreports_server
- Cloud Jasperreports_studio
- Cloud Jasperreports_web_studio
- Jaspersoft Jasperreports Io At-scale — versions 0
- Jaspersoft Jasperreports Io Professional — versions 0
- Jaspersoft Jasperreports Library Community Edition — versions 0
- Jaspersoft Jasperreports Library Professional — versions 0
- Jaspersoft Jasperreports Server — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- db6d2600-d19b-4111-a010-f3c4ed70cd50 (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-10492?
- CVE-2025-10492 is a critical-severity vulnerability in Cloud Jasperreports_io, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-09-16.
- How severe is CVE-2025-10492?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2025-10492 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.