Jackrabbit WebDAV Surfaces: 2,254 Body Matches Against 237 Titles
Jackrabbit WebDAV Surfaces: 2,254 Body Matches Against 237 Titles Apache Jackrabbit fixed two flaws on 2026-10-07, including a WebDAV session hijack rated 9.3 and an unsafe reflection issue in the DavEx client rated 6.9. The repository is embedded in content management platforms, so its WebDAV endpoint is not always an obvious internet service. The fingerprint question here is whether the…
Apache Jackrabbit, an embedded content management platform, has been found to have two vulnerabilities that can be exploited through its WebDAV endpoint. The first flaw, CVE-2026-92414, is a session hijack issue that has been rated 9.3. The second, CVE-2026-92415, is an unsafe reflection problem in the DavEx client, rated 6.9. These vulnerabilities were fixed on October 7, 2026.
The body of the response from a Jackrabbit server returns roughly nine times more matches than when searching for the product name in the page title. This is significant because a title match indicates the string appears in a login or administration page, while a body match shows the marker anywhere in the response, typically in XML or JSON formats. These findings suggest that the vulnerabilities are more likely to be exploited through body matches rather than title matches.
To mitigate the risk, it is recommended to inventory applications that use Jackrabbit and check if they publish a WebDAV endpoint outside the internal network. Users should then upgrade to versions 2.23.6, 2.22.5, or 2.20.18, depending on the maintained branch.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
