This is an automated email from the ASF dual-hosted git repository. afs pushed a commit to branch advisory in repository https://gitbox.apache.org/repos/asf/jena-site.git
commit 59cf0d2e6ebb571bf7822c01b67045ea9fc43ca6 Author: Andy Seaborne <[email protected]> AuthorDate: Tue Jul 28 19:01:56 2026 +0100 Update advisories.md --- source/security/advisories.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/source/security/advisories.md b/source/security/advisories.md index 95f4a0c1e..bdc7cb218 100644 --- a/source/security/advisories.md +++ b/source/security/advisories.md @@ -14,6 +14,17 @@ the latest Jena release available. Please refer to the individual CVE links for further details and mitigations. +**CVE-2026-61372 Web requests using SPARQL Update can escape file restrictions** + +[CVE-2026-61372](https://www.cve.org/CVERecord?id=CVE-20-613372) affects Jena +up to version 6.1.0. + +URL references to local resources in SPARQL Update requests were not being +correctly restricted, and could include access to data on the local machine. + +Users are recommended to upgrade to version 6.2.0 where such URLs are restricted +to be HTTP or FTP URLs. + **CVE-2025-50151 - Configuration files uploaded by administrative users are not checked properly** [CVE-2025-50151](https://www.cve.org/CVERecord?id=CVE-2025-50151) affects Jena
