CVE-2026-92415

Apache Jackrabbit's WebDAV/DavEx client unsafely lets externally supplied data choose which class to load (CWE-470). A malicious WebDAV/DavEx server, or an attacker who can intercept the connection, can cause the client to instantiate arbitrary classes from its classpath; public reporting describes Class.forName plus a single-string constructor driven by server-controlled error bodies. That can create or truncate arbitrary files on the client host; the advisory does not claim confidentiality or availability impact, and Jackrabbit servers are not affected. Only applications on the listed 2.20, 2.22, and 2.23 ranges that use jackrabbit-spi2dav directly or through jackrabbit-jcr2dav to reach a remote repository are vulnerable. No public proof-of-concept is known, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade the Jackrabbit client libraries to 2.23.6, 2.22.5, or 2.20.18 on the release line you use. Only applications that connect to a remote repository via jackrabbit-spi2dav or jackrabbit-jcr2dav need this fix; Jackrabbit servers are not affected. Until upgraded, point those clients only at trusted DavEx endpoints over TLS so an on-path attacker cannot substitute class names in responses.