What is the CVSS score of CVE-2026-61372?

CVE-2026-61372 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache Jena Fuseki are affected by CVE-2026-61372?

Apache Jena Fuseki versions through 6.1.0 contain a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from affected systems.

How to fix or mitigate CVE-2026-61372?

Within 24 hours, identify all systems running Apache Jena Fuseki versions 6.1.0 and earlier and implement network access controls to restrict Fuseki endpoints to authorized networks only; simultaneously, assess data sensitivity and exposure scope with Fuseki deployment teams. Within 7 days, deploy a reverse proxy with path-based filtering to block traversal patterns and establish monitoring for suspicious file access requests. Within 30 days, track Apache Jena project patch announcements and plan an upgrade strategy once a patched version is released; maintain network segregation and access controls as your primary interim mitigation.

Apache Jena Fuseki CVE-2026-61372

EUVD-2026-52338 HIGH

Path Traversal (CWE-22)

2026-08-03

GHSA-g2qm-wc55-9539

Apache Path Traversal Jena Fuseki

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable with no authentication required (PR:N, AC:L); read-only file disclosure yields High confidentiality impact with no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 20:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 20:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 03, 2026 - 16:16 vuln.today

CVE Published

Aug 03, 2026 - 15:30 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 5 New Apache Vulnerabilities - 5 High Severity, 2 With POC Aug 04, 2026 News 3 New Apache Vulnerabilities - 1 Critical, 2 With POC Aug 03, 2026

AnalysisAI

Path traversal in Apache Jena Fuseki (all versions through 6.1.0) allows unauthenticated remote attackers to read arbitrary files outside the application's intended directory via crafted HTTP requests. The CVSS 3.1 score of 7.5 with High Confidentiality impact and no authentication required (PR:N, AC:L) underscores a low-barrier information disclosure risk against any network-accessible Fuseki instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions make this a meaningful priority for organizations exposing Fuseki to untrusted networks.

Technical ContextAI

Apache Jena Fuseki is an HTTP-based SPARQL 1.1 server and linked-data endpoint built on the Apache Jena RDF framework, commonly used in semantic web and knowledge graph deployments. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause as insufficient canonicalization or sanitization of user-supplied path components in Fuseki's HTTP request handling - likely in dataset or resource serving logic - allowing sequences such as '../' to escape the application's restricted working directory and reference arbitrary files on the host filesystem. The vulnerability spans all releases up to and including 6.1.0 per the EUVD entry (EUVD-2026-52338), suggesting the flaw existed in core path-handling logic for an extended period. No CPE strings were supplied in the input data, so exact artifact identifiers cannot be cited.

RemediationAI

Vendor-released patch: Apache Jena Fuseki 6.2.0. Users are directed by the vendor to upgrade immediately to version 6.2.0, which contains the fix. The advisory is available at https://lists.apache.org/thread/h206tpxtbzts7m254og6ffqljjdjkm84 and https://seclists.org/oss-sec/2026/q3/391. If immediate upgrade is not feasible, restrict network access to the Fuseki HTTP interface (default port 3030) using firewall rules or reverse-proxy ACLs so only trusted IP ranges can reach it - note this reduces attack surface but does not eliminate the vulnerability and may impact legitimate SPARQL consumers. Additionally, ensure the Fuseki process runs under a dedicated least-privilege service account with read access scoped only to required dataset directories, limiting what files an attacker could retrieve if exploitation occurs. Placing an authenticating reverse proxy (e.g., nginx with HTTP Basic or OAuth2) in front of Fuseki provides an additional deterrent layer but introduces operational overhead for existing unauthenticated SPARQL clients.