CVE-2026-92415

Executive Summary

CVE-2026-92415 is a use of externally-controlled input to select classes or code (CWE-470) vulnerability in the WebDAV/DavEx client component of Apache Jackrabbit. A malicious or intercepted WebDAV/DavEx server can cause a client application to instantiate arbitrary classes present on its classpath, which can lead to arbitrary file creation or truncation. Only applications using jackrabbit-spi2dav (directly or via jackrabbit-jcr2dav) to connect to a remote repository are affected; Jackrabbit servers themselves are not impacted. At the time of writing, no public PoC, exploit code, or vendor patch has been observed, and the CVE remains unpatched in tracked sources.

Technical Analysis

The vulnerability class here is unsafe reflection on wire data. Apache Jackrabbit's jackrabbit-spi2dav module implements the SPI (Service Provider Interface) over the WebDAV protocol, and jackrabbit-jcr2dav layers the JCR API on top of it. When connecting to a remote repository, the client processes responses and metadata supplied by the server. The NVD description states that a malicious WebDAV/DavEx server — or an attacker positioned to intercept the connection — can cause the client to instantiate arbitrary classes from its classpath.

The core defect is CWE-470: the client uses externally-controlled input (data received from the server over the wire) to select which class or code path to instantiate. Because the selection value is attacker-influenced, an adversary can steer the client into loading an unintended class. The description explicitly attributes the resulting impact to "arbitrary file creation or truncation." This indicates that the instantiated classes have side effects on the filesystem, most plausibly code paths that open or write to file paths influenced by server-supplied data. No specific class names, method names, URL endpoints, or parameter names are provided in the NVD description, so the precise instantiation mechanism cannot be reconstructed from available data.

Affected versions are Apache Jackrabbit 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17. The attack surface is the client-to-server WebDAV/DavEx connection, which means an external network peer (the repository server) or a man-in-the-middle on that connection is the threat vector. Confirmed fix versions are 2.23.6, 2.22.5, and 2.20.18. The CVSS vector is not finalized (N/A); the vector shown here is an inferred assessment based on network-reachable, non-privileged, no-user-interaction preconditions with partial confidentiality, high integrity, and partial availability impact.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies an application that uses jackrabbit-spi2dav or jackrabbit-jcr2dav to connect to a remote repository. Such applications connect outbound to a WebDAV/DavEx endpoint. The attacker must control that endpoint (by hosting a malicious repository, compromising the legitimate one, or intercepting the connection).

2. Trigger of the flaw class: When the client establishes or performs operations against the malicious/intercepted WebDAV/DavEx server, the server returns crafted data. Because the client uses externally-controlled input to select classes or code, the attacker's data determines which class the client instantiates from its own classpath. The exact wire message and field are not documented in the available description.

3. Payload / execution: The attacker supplies a value that selects an unintended class available on the client's classpath. The class is instantiated by the client process, executing code paths chosen by the attacker.

4. Post-exploitation impact: Per the NVD description, this can lead to arbitrary file creation or truncation on the client host. File truncation can cause data destruction or denial of service for the affected application; file creation can be leveraged to write files in attacker-chosen locations, which in some deployments may be chained into further compromise depending on what is writable and what consumes those files.

No exploit-in-the-wild activity, KEV listing, or threat actor campaign has been reported for this CVE.

Impact Assessment

The blast radius is limited to client applications connecting to remote repositories via jackrabbit-spi2dav or jackrabbit-jcr2dav. Jackrabbit servers are explicitly not affected, so a repository deployment that only serves content is out of scope. Impact is primarily integrity (arbitrary file creation or truncation) with potential availability loss where truncation destroys data or breaks application state. Confidentiality impact is lower and opportunistic — an attacker may infer filesystem structure or observe which classes exist via differential behavior. CVSS subscores are not published (N/A); the inferred vector reflects network attack (AV:N), high attack complexity (AC:H, requiring a malicious or intercepted server), no privileges (PR:N), no user interaction (UI:N), scope unchanged (S:U), low confidentiality (C:L), high integrity (I:H), and low availability (A:L). EPSS has not yet been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Potential Apache Jackrabbit WebDAV/DavEx Unsafe Class Instantiation
id: 3b6f1c2a-9d4e-4f7a-8c1b-2a5e7f9d6b30
status: experimental
description: Detects client-side jackrabbit-spi2dav / jackrabbit-jcr2dav activity indicative of CVE-2026-92415, where server-supplied data selects classes for instantiation leading to file creation or truncation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92415
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.92415
logsource:
  category: process_creation
  product: linux
detection:
  selection_java:
    Image|endswith: '/java'
  selection_jackrabbit:
    CommandLine|contains:
      - 'jackrabbit-spi2dav'
      - 'jackrabbit-jcr2dav'
  selection_suspicious:
    CommandLine|contains:
      - 'dav:'
      - 'webdav'
  condition: selection_java and selection_jackrabbit and selection_suspicious
falsepositives:
  - Legitimate applications using jackrabbit-spi2dav against trusted repositories
  - Development and testing environments
level: medium

YARA Rule

rule CVE_2026_92415_Jackrabbit_WebDAV_ClassInstantiation
{
    meta:
        description = "Detects classpath artifacts and client code associated with Apache Jackrabbit WebDAV/DavEx unsafe class instantiation (CVE-2026-92415)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92415"
        severity = "high"

    strings:
        $spi2dav = "jackrabbit-spi2dav"
        $jcr2dav = "jackrabbit-jcr2dav"
        $webdav  = "org.apache.jackrabbit.spi2dav"
        $xclass  = "externally-controlled"
        $err1    = "ClassNotFoundException"
        $err2    = "ClassCastException"
        $pkg     = "org.apache.jackrabbit"

    condition:
        uint32(0) == 0x504b0304 and
        (
            (2 of ($spi2dav, $jcr2dav, $webdav, $pkg)) or
            ($xclass and $pkg)
        ) and
        any of ($err*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443,8080] (msg:"CVE-2026-92415 Apache Jackrabbit WebDAV/DavEx Server-Supplied Class Selection"; flow:established,to_server; content:"PROPFIND"; http_method; content:"Depth|3a|"; http_header; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-92415; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92415; sid:9241501; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-92415 Apache Jackrabbit WebDAV/DavEx Suspicious Class Selection Response"; flow:established,to_client; content:"HTTP/1."; content:"|0d 0a|Content-Type|3a 20|application/xml"; http_header; pcre:"/org\.apache\.jackrabbit\./i"; threshold:type both, track by_dst, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-92415; sid:9241502; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where process.name == "java" and process.args : ("*jackrabbit-spi2dav*", "*jackrabbit-jcr2dav*")]
  [file where event.action in ("creation", "deletion") and file.extension != null and process.name == "java"]

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR sourcetype=linux:syslog OR sourcetype=java:app
(CommandLine="*jackrabbit-spi2dav*" OR CommandLine="*jackrabbit-jcr2dav*" OR Message="*org.apache.jackrabbit.spi2dav*")
AND (Message="*WebDAV*" OR Message="*DavEx*" OR CommandLine="*dav*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, CommandLine, Message
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="apache_jackrabbit,cve-2026-92415,">
  <rule id="924150" level="10">
    <decoded_as>json</decoded_as>
    <field name="full_log">jackrabbit-spi2dav|jackrabbit-jcr2dav</field>
    <description>CVE-2026-92415: Apache Jackrabbit WebDAV/DavEx client detected - potential unsafe class instantiation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92415,</group>
  </rule>

  <rule id="924151" level="12">
    <decoded_as>json</decoded_as>
    <field name="full_log">org.apache.jackrabbit.spi2dav</field>
    <description>CVE-2026-92415: Suspicious Jackrabbit SPI2DAV class activity possibly leading to file creation/truncation</description>
    <group>cve_2026_92415,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workarounds are documented in the available data.

1. Immediate mitigations:

• Restrict network egress from client applications using jackrabbit-spi2dav or jackrabbit-jcr2dav to only known, trusted repository endpoints; this denies both a malicious server and an interception position.
• Enforce TLS certificate validation (mutual TLS where possible) so that an attacker cannot man-in-the-middle the WebDAV/DavEx connection to inject crafted responses.
• Monitor and audit client-side filesystem writes for the affected JVM process; alert on unexpected file creation or truncation, especially during repository operations.
• Where the feature is not required, remove or avoid jackrabbit-spi2dav / jackrabbit-jcr2dav client usage.

2. Patch/upgrade steps:

• Upgrade Apache Jackrabbit to 2.23.6, 2.22.5, or 2.20.18, which the advisory identifies as the fixed versions for the affected branches.
• Verify the updated jackrabbit-spi2dav and jackrabbit-jcr2dav artifacts are on the classpath and no vulnerable version remains in the dependency tree (check transitive dependencies and shaded JARs).
• Redeploy affected client applications after verifying dependency convergence.

3. Long-term hardening:

• Treat all data received from remote repository servers as untrusted; validate and allowlist any class or code selection driven by wire data.
• Minimize the client-side classpath and remove unnecessary classes that could otherwise be instantiated by an attacker.
• Apply least-privilege filesystem permissions to the JVM's service account to bound the impact of arbitrary file creation or truncation.
• Add dependency and SBOM monitoring to track Apache Jackrabbit versions and alert on future advisories.

References

• NVD — CVE-2026-92415: https://nvd.nist.gov/vuln/detail/CVE-2026-92415
• Apache Software Foundation security advisories: https://jackrabbit.apache.org/ (see security page and release notes for 2.23.6, 2.22.5, 2.20.18)
• CWE-470 — Use of Externally-Controlled Input to Select Classes or Code: https://cwe.mitre.org/data/definitions/470.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• No CISA KEV entry, public PoC, exploit-in-the-wild evidence, or known threat actor campaign associated with this CVE has been observed at the time of reporting.