CVE-2026-61372: Apache Jena Fuseki Path Traversal Flaw

CVE-2026-61372 Overview

CVE-2026-61372 is a path traversal vulnerability in Apache Jena Fuseki, a SPARQL server used to publish and query RDF datasets. The flaw affects all versions through 6.1.0 and stems from improper limitation of a pathname to a restricted directory [CWE-22]. Remote unauthenticated attackers can craft requests that traverse outside the intended directory structure to read files accessible to the Fuseki process. Apache has released version 6.2.0 to address the issue.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the server hosting Apache Jena Fuseki, exposing configuration data, credentials, and other sensitive information.

Affected Products

Apache Jena Fuseki versions through 6.1.0
SPARQL endpoints deployed with vulnerable Fuseki server builds
Applications embedding Apache Jena Fuseki as a component

Discovery Timeline

2026-08-03 - CVE-2026-61372 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-61372

Vulnerability Analysis

Apache Jena Fuseki exposes HTTP endpoints for administering datasets, serving static resources, and processing SPARQL queries. The server fails to properly canonicalize and validate user-supplied path components before resolving them against the filesystem. An attacker can supply traversal sequences such as ../ in a request path to escape the intended web root or dataset directory.

The issue is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation returns file contents to the attacker over HTTP, exposing configuration files, shiro configuration, TLS keys, and credentials stored on disk. The confidentiality impact is high while integrity and availability are unaffected.

Exploitation requires only network access to the Fuseki HTTP interface. No authentication, user interaction, or elevated privileges are needed. The current EPSS probability is 0.383% at the 31st percentile.

Root Cause

The root cause is insufficient sanitization of path segments in request handlers that map URIs to filesystem resources. The server accepts encoded and unencoded traversal sequences and resolves them without enforcing a strict base-directory containment check.

Attack Vector

Attackers send crafted HTTP requests to the Fuseki endpoint that include directory traversal sequences in the URL path. The server resolves these paths relative to the intended resource directory and returns files located outside that directory. Refer to the Apache Mailing List Thread and the Openwall OSS Security Update for advisory details.

Detection Methods for CVE-2026-61372

Indicators of Compromise

HTTP request logs containing ../, ..%2f, ..%5c, or double-encoded traversal patterns targeting Fuseki paths
Unexpected 200 responses to requests referencing files outside standard Fuseki dataset or static resource paths
Access log entries requesting sensitive files such as /etc/passwd, shiro.ini, or Fuseki configuration files via HTTP

Detection Strategies

Inspect Fuseki access logs and reverse proxy logs for path segments containing traversal sequences or unusual encodings
Deploy WAF or ingress rules that flag requests containing .. sequences targeting the Fuseki service
Correlate outbound file reads by the Fuseki process with inbound HTTP requests to identify traversal-driven disclosure

Monitoring Recommendations

Alert on HTTP 200 responses to Fuseki endpoints for URIs that do not match the expected dataset routing patterns
Monitor the Fuseki process for reads of files outside its configured data directory using file integrity monitoring
Track version banners exposed by Fuseki to identify hosts still running versions through 6.1.0

How to Mitigate CVE-2026-61372

Immediate Actions Required

Upgrade Apache Jena Fuseki to version 6.2.0 or later on all affected hosts
Restrict network access to Fuseki administrative and query endpoints to trusted networks only
Rotate credentials, TLS keys, and API tokens stored on any Fuseki host that may have been exposed

Patch Information

Apache has released Apache Jena Fuseki 6.2.0, which fixes the path traversal issue. Users on any version through 6.1.0 should upgrade. See the Apache Mailing List Thread for the official announcement.

Workarounds

Place Fuseki behind a reverse proxy that normalizes URIs and rejects traversal sequences before they reach the server
Run Fuseki under a dedicated low-privilege service account with filesystem access restricted to its data directory
Apply WAF rules that block URI patterns containing .., %2e%2e, or other encoded traversal indicators

bash

# Example reverse proxy rule to reject path traversal attempts
location /fuseki/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e|%252e)") {
        return 400;
    }
    proxy_pass http://fuseki_backend;
}