{
  "id": 14531143,
  "title": "Jackrabbit WebDAV Surfaces: 2,254 Body Matches Against 237 Titles",
  "url": "https://urgent.news/2026/10/14/jackrabbit-webdav-surfaces-2-254-body-matches-against-237-titles",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T20:41:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/onaeiuspkz/jackrabbit-webdav-surfaces-2254-body-matches-against-237-titles-ohn"
  },
  "original_language": "en",
  "account": "Apache Jackrabbit, an embedded content management platform, has been found to have two vulnerabilities that can be exploited through its WebDAV endpoint. The first flaw, CVE-2026-92414, is a session hijack issue that has been rated 9.3. The second, CVE-2026-92415, is an unsafe reflection problem in the DavEx client, rated 6.9. These vulnerabilities were fixed on October 7, 2026.\n\nThe body of the response from a Jackrabbit server returns roughly nine times more matches than when searching for the product name in the page title. This is significant because a title match indicates the string appears in a login or administration page, while a body match shows the marker anywhere in the response, typically in XML or JSON formats. These findings suggest that the vulnerabilities are more likely to be exploited through body matches rather than title matches.\n\nTo mitigate the risk, it is recommended to inventory applications that use Jackrabbit and check if they publish a WebDAV endpoint outside the internal network. Users should then upgrade to versions 2.23.6, 2.22.5, or 2.20.18, depending on the maintained branch.",
  "summary": "Jackrabbit WebDAV Surfaces: 2,254 Body Matches Against 237 Titles Apache Jackrabbit fixed two flaws on 2026-10-07, including a WebDAV session hijack rated 9.3 and an unsafe reflection issue in the DavEx client rated 6.9. The repository is embedded in content management platforms, so its WebDAV endpoint is not always an obvious internet service. The fingerprint question here is whether the…",
  "key_points": [
    "Apache Jackrabbit has two vulnerabilities (CVE-2026-92414, CVE-2026-92415)",
    "Jackrabbit's WebDAV endpoint exploited through body matches (2,254 matches vs. 237 titles)",
    "Vulnerabilities fixed on October 7, 2026; upgrade recommended"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}