A malicious WebDAV/DavEx server, or an attacker who can intercept the traffic, can send a specially crafted error body that the Jackrabbit client interprets as a class name. The client then uses Class.forName and the String constructor to instantiate that class from its own classpath. This unsafe reflection (CWE-470) allows an attacker to create or truncate files on the client system and may facilitate further compromise, though the description does not explicitly confirm code execution. The vulnerability is limited to the client side and requires the client to use the jackrabbit-spi2dav or jackrabbit-jcr2dav libraries to connect to a remote repository.

The vulnerability affects Apache Jackrabbit versions 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, but only when applications employ jackrabbit-spi2dav or jackrabbit-jcr2dav to connect to a remote repository. Jackrabbit servers themselves are not impacted.

The CVSS score of 6.9 indicates moderate severity combined with high impact potential. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path is remote: a client can be tricked into connecting to a malicious or compromised WebDAV/DavEx server, or an attacker can intercept and modify the traffic to inject the malicious payload. The exploit does not require special client credentials or privileges beyond normal connectivity to the remote repository, so the risk depends primarily on the trust relationship with the remote server and the lack of protective network controls.