Details

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-10492
• https://github.com/Jaspersoft/jasperreports/issues/542
• https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647
• https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569
• https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6
• https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition
• https://github.com/Jaspersoft/jasperreports

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

v7.0.4

Compare Source

• add deserialization class filter to fix the CVE-2025-10492 security vulnerability;

• new net.sf.jasperreports.export.docx.size.page.to.content export configuration property
  added to support variable DOCX page size;

• minor bug fixes and improvements;

v7.0.3

Compare Source

• minor bug fixes and improvements;

v7.0.2

Compare Source

• added support for horizontalPosition and shrinkWidth properties to table component and weight
  property to table columns to better control table resize behavior when table columns are hidden or resized.

• removed the Google Maps component, the Chrome server side rendering of Javascript visualizations extension,
  the interactivity extension as well as the PL/SQL and Oracle stored procedure query executer;

• various dependencies upgrades including: Apache Batik 1.18, Apache POI 5.3.0 and Spring 6.2.3;

• minor bug fixes and improvements;

v7.0.1

Compare Source

• added automatic module names to manifest files and fixed split packages issues in preparation for
  Java 9 modules compliance;

• minor bug fixes and improvements;

v7.0.0

Compare Source

• removal of the Ant build system and replacing it with a Maven build system;

• deprecated code removed;

• breaking backward compatibility of serialized/compiled *.jasper report template files,
  mostly because of historical deprecated serialization code removal/cleanup mentioned above
  (source *.jrxml report templates need to be recompiled to *.jasper using the new version of
  the library);

• breaking backward compatibility of source *.jrxml report template files and *.jrtx style
  template files by replacing the Apache Commons Digester based parsers with Jackson XML object
  serialization. *.jrxml and *.jrtx files created with version 6 or older can no longer be loaded
  with version 7 or newer of the library alone. The conversion from the old file formats to the new
  file formats and back can be made using Jaspersoft Studio 7 and later versions of it;

• extracting various optional extension JAR artifacts from the the core library JAR artifact
  to allow the Jakarta Migration of certain of these optional features while also introducing
  better third party Maven dependency management of these artifacts;

• some Java package names have changed as a consequence of separating functionality into optional JAR artifacts;

• upgraded JFreeChart to version 1.5.4 which no longer has support for 3D charts. Reports having
  Pie 3D, Bar 3D and Stacked Bar 3D charts would continue to work, but will be rendered as 2D,
  all their 3D effects being ignored;

• minor bug fixes and improvements;

v6.21.5: JasperReports 6.21.5

Compare Source

• added support for horizontalPosition and shrinkWidth properties to table component and weight
  property to table columns to better control table resize behavior when table columns are hidden or resized.

• various dependencies upgrades including: Spring 6.2.3, Apache Batik 1.18,
  Apache Commons Codec 1.18.0, Apache Commons IO 2.18.0, Apache Commons Logging 1.3.5,
  Apache Log4J 2.24.3, Apache Commons Collections 4.5.0 and Apache POI 5.4.1;

• minor bug fixes and improvements;

v6.21.4: JasperReports 6.21.4

Compare Source

• various dependencies upgrades including: Jackson 2.17.1, RequireJS 2.3.7, Apache POI 5.3.0
  and Apache Xalan 2.7.3;

• minor bug fixes and improvements;

v6.21.3

Compare Source

• allow background section elements to be exported as page header content in the DOCX exporter
  so that watermark type effects could be achieved;

• minor bug fixes and improvements;

v6.21.2

Compare Source

• minor bug fixes and improvements;

v6.21.0

Compare Source

• added support for PDF/A-2a, PDF/A-2b, PDF/A-2u, PDF/A-3a, PDF/A-3b, PDF/A-3u;

• added support for WEBP images;

• minor bug fixes and improvements;