Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Apache Commons OGNL may let attackers run code

CVE-2025-53192 · published 1 year ago
Summary

All versions of Apache Commons OGNL can be tricked into running malicious code when it evaluates user‑provided expressions. The built‑in safeguards do not block every dangerous class, so a clever attacker could bypass them and execute commands on the server. The project is no longer maintained, so the safest steps are to replace this library with a supported alternative or restrict its use to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– apache commons_ognl All versions
cpe:2.3:a:apache:commons_ognl:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical ognl All versions
Original advisory text
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the A...
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods, etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-146Improper Neutralization of Expression/Command Delimiters
Timeline
Published18 Aug 2025
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-53192 · NVD
UBUNTU-CVE-2025-53192 · OSV
Track software like this
Free during beta