CVE-2026-61372

CVE-2026-61372: Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions

Vendor Apache Software Foundation

Product Apache Jena Fuseki

Weakness CWE-22 · Path traversal

Published August 3, 2026

Last update August 3, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

Key dates

02Disclosure timeline

August 3, 2026 CVE published

August 3, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-61372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-57815 WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVE-2026-32477 WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability