CVE-2025-48734

Apache Commons BeanUtils has an improper access control flaw that allows attackers to retrieve the declaredClass property from Java enum objects when they supply unchecked property paths to PropertyUtilsBean. The declaredClass property exposes the enum's class loader, giving an attacker the ability to load and execute arbitrary code, effectively enabling remote code execution. This weakness is represented by CWE-284 (Improper Access Control).

Applications using Apache Commons BeanUtils version 1.x before 1.11.0 or 2.x before 2.0.0-M2 are affected, including many Red-Hat distributions that incorporate the library in products such as AMQ Streams 2.9, Apache Camel Spring Boot 4, Camel Quarkus 3, Cryostat 4, JBoss Enterprise Application Platform 7, 7.4, 8, and their various Linux releases. Any service that passes untrusted property paths to the getProperty or getNestedProperty methods is potentially vulnerable.

The CVSS score of 8.8 indicates a high severity of the vulnerability, but the EPSS score of 1% suggests a low probability of exploitation at this time. The flaw is not included in the CISA KEV catalog. Attackers would need to provide crafted property paths that reference the declaredClass property; if successful, they can exploit the class-loader exposure to run arbitrary code on the application's host. The vulnerability is exploitable from the application level, and an attacker does not need direct network access to the system itself beyond the vector that allows injection of the property path.