Technical impact
This vulnerability is a CWE‑22 path traversal flaw that allows an attacker to escape the intended file restrictions when submitting SPARQL Update requests to the Apache Jena Fuseki web service. By including path traversal sequences in the update payload, the server may read or modify files located outside its designated data directory, potentially exposing sensitive information or altering critical configuration files.
Affected Systems
The affected product is Apache Jena Fuseki provided by the Apache Software Foundation. Versions up through 6.1.0 are vulnerable; the issue is resolved in 6.2.0 and later releases.
Risk and Exploitability
The CVSS score is 7.5, the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires network access to the Fuseki instance and the ability to craft SPARQL Update commands that incorporate directory traversal components such as '../'. If the Fuseki endpoint is exposed to untrusted networks, an attacker can readily exploit the flaw to read or modify arbitrary files, which can compromise confidentiality, integrity, and availability of the system.
