JasperReports has a Java deserialisation vulnerability

CRITICAL 9.8CVE-2025-10492 · GHSA-7c3f-cg9x-f3gr · Published 16/09/2025 · updated 17/06/2026

In short

CVE-2025-10492 is a CRITICAL (CVSS 9.8) vulnerability affecting net.sf.jasperreports:jasperreports, jasperreports io (cloud), jasperreports library (cloud).
Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.4% of all vulnerabilities.
Fix: update to 7.0.4 or later.

Package	Affected versions	Patched versions
net.sf.jasperreports:jasperreports Maven	`< 7.0.4`	`7.0.4`
jasperreports io cloud	`≤ 4.0.0`	No fix yet
jasperreports library cloud	`≤ 7.0.3≤ 9.0.2`	No fix yet
jasperreports server cloud	`≤ 9.0.0`	No fix yet
jasperreports studio cloud	`≤ 7.0.3≤ 9.0.2`	No fix yet
jasperreports web studio cloud	`≤ 3.0.1`	No fix yet

Description

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

NVD description

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

References

More vulnerabilities in net.sf.jasperreports:jasperreports

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free