CVE-2025-10492 — Jaspersoft Library Deserialisation Vulnerability

Description (CNA)

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Affected (CNA)

Vendor / product	Versions
Jaspersoft / JasperReports Library Community Edition	affected 0 through 7.0.3
Jaspersoft / Jaspersoft Studio Community Edition	affected 0 through 7.0.3
Jaspersoft / JasperReports Server	affected 0 through 9.0.0
Jaspersoft / JasperReports Library Professional	affected 0 through 9.0.2
Jaspersoft / Jaspersoft Studio Professional	affected 0 through 9.0.2
Jaspersoft / JasperReports IO Professional	affected 0 through 4.0.0
Jaspersoft / JasperReports IO At-Scale	affected 0 through 4.0.0
Jaspersoft / JasperReports Web Studio	affected 0 through 3.0.1

CWE

CWE-502

References

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition