CVE-2025-48734 in Commons BeanUtils
Summary
by MITRE • 05/28/2025
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/26/2026
The vulnerability CVE-2025-48734 represents a critical improper access control issue within Apache Commons BeanUtils, a widely used Java library for manipulating JavaBean properties through reflection. This security flaw stems from the library's handling of Java enum objects and their associated metadata, specifically the "declaredClass" property that exposes underlying class loader information. The vulnerability was introduced due to insufficient default security configurations in the library's property access mechanisms, creating a pathway for remote code execution through carefully crafted property access requests. The issue affects both major versions of the library, with 1.x versions before 1.11.0 and 2.x versions before 2.0.0-M2 being particularly vulnerable to exploitation.
The technical implementation of this vulnerability involves the PropertyUtilsBean and BeanUtilsBean classes that process property paths from external sources. When applications pass untrusted input directly to the getProperty() or getNestedProperty() methods, attackers can exploit the enum's "declaredClass" property to gain access to the underlying ClassLoader. This access enables attackers to execute arbitrary code on the target system, as demonstrated by the ability to manipulate class loading mechanisms through the exposed metadata. The vulnerability specifically targets Java's enum implementation where each enum instance maintains a reference to its declaring class through the declaredClass property, which becomes accessible through the bean property access system when proper safeguards are not in place. This issue aligns with CWE-284 (Improper Access Control) and represents a classic example of insufficient input validation in reflection-based systems.
The operational impact of this vulnerability extends beyond simple privilege escalation to full remote code execution capabilities, making it particularly dangerous for web applications and services that rely on Commons BeanUtils for data binding or property manipulation. Attackers can leverage this vulnerability in applications that process user input through bean property access mechanisms, potentially leading to complete system compromise. The vulnerability is especially concerning in environments where applications process untrusted data through the library's property access methods, as it can be exploited without requiring authentication or specific privileges beyond the ability to provide input to the affected application. Organizations using older versions of Apache Commons BeanUtils face significant risk exposure, particularly those running web applications, enterprise systems, or any service that accepts external property paths for bean manipulation.
The security fix implemented in versions 1.11.0 and 2.0.0-M2 introduces a new BeanIntrospector class that suppresses access to the "declaredClass" property by default, effectively blocking the attack vector. This mitigation approach follows the principle of least privilege by ensuring that the dangerous property access is disabled unless explicitly required by the application. The fix maintains backward compatibility through configurable settings, allowing administrators to disable the protection if necessary for legacy applications, though this is strongly discouraged. Organizations should prioritize upgrading to the patched versions, with version 1.11.0 for 1.x users and 2.0.0-M2 for 2.x users. The solution aligns with ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) and T1068 (Exploitation for Privilege Escalation) by preventing the exploitation of reflection-based vulnerabilities that could lead to arbitrary code execution. Security teams should also implement monitoring for any attempts to access enum properties through the affected library methods and ensure that all applications using Commons BeanUtils are updated to prevent potential exploitation attempts.