Security Advisories

August 2026

Update 2 - Unauthenticated JRXML expression injection allows remote code execution

Description

This advisory serves as an update to the last entry, where a new hotfix is available. See Update 1 for context:

"An unauthenticated remote code execution (RCE) vulnerability exists through the JasperReportsMenu plugin, affecting ALL versions of Joget, regardless of whether JasperReports is utilized within the application. The flaw stems from an anonymously accessible endpoint that processes caller-controlled userview JSON without adequate restriction, allowing attackers to supply malicious JRXML report markup."

Severity

Critical and Urgent

Affected Versions

All Versions - Includes but not limited to - Joget v6, Joget DX 7, Joget DX 8, Joget DX 9

Resolution

Option A: Apply the Hotfix (Recommended)

Download the joget-jasperreports-rce-hotfix-2260-candidate-update2 before proceeding. The hotfix also fixes a regression where JasperReports is not able to render in recent versions.

1. If you have applied the Workaround as per the section in Update 1 or using Option B, undo it before proceeding to step 2.
2. Extract the hotfix zip contents directly over the exploded webapp root (the directory containing WEB-INF/). E.g <tomcat>/webapps/jw/), after extraction, you should have:
   
   • WEB-INF/classes/jasperreports.properties
   • WEB-INF/lib/groovy-sandbox-1.26-jaspersoft-2.jar
   • WEB-INF/lib/jasperreports-groovy-method-guard-aspect-1.0.0.jar
3. Restart the Joget server.
4. To validate the hotfix, use the following sample JRXML script:
   For Linux or macOS:
   

   <?xml version="1.0" encoding="UTF-8"?>
   <jasperReport xmlns="http://jasperreports.sourceforge.net/jasperreports"
      name="poc_execute" language="groovy" whenNoDataType="AllSectionsNoDetail"
      pageWidth="595" pageHeight="842" columnWidth="555"
      leftMargin="20" rightMargin="20" topMargin="20" bottomMargin="20">
      <title>
          <band height="30">
              <textField>
                  <reportElement x="0" y="0" width="555" height="20"/>
                  <textFieldExpression><![CDATA["touch /tmp/jasper_rce_poc_marker.txt".execute().waitFor().toString()]]></textFieldExpression>
              </textField>
          </band>
      </title>
   </jasperReport>

   For Windows:
   

   <?xml version="1.0" encoding="UTF-8"?>
   <jasperReport xmlns="http://jasperreports.sourceforge.net/jasperreports"
       name="poc_execute" language="groovy" whenNoDataType="AllSectionsNoDetail"
       pageWidth="595" pageHeight="842" columnWidth="555"
       leftMargin="20" rightMargin="20" topMargin="20" bottomMargin="20">
       <title>
           <band height="30">
               <textField>
                   <reportElement x="0" y="0" width="555" height="20"/>
                   <!-- Note Replace <username> below with your actual Windows account username -->
                   <textFieldExpression><![CDATA["cmd.exe /c type nul > C:\\Users\\<username>\\AppData\\Local\\Temp\\jasper_rce_poc_marker.txt".execute().waitFor().toString()]]></textFieldExpression>
               </textField>
           </band>
       </title>
   </jasperReport>

1. 1. Open the UI Builder in any of your apps, drag in a JasperReports menu element, and paste the JRXML script in the Jasper Reports Definition (JRXML) field.
      
   2. Click Apply Change. Navigate to Administrator Bar > Monitor > System Logs.
      • If the block is successful, an error message containing identifiable words such as “...SecurityException: Method 'xx' is not allowed….“ The following is a sample of error logs returned in the server logs if the block is successful:
        

        19-Aug-2026 22:43:49.837 WARNING [http-nio-8080-exec-7] org.joget.aspect.jasperreports.GroovyReportMethodGuardAspect.deny Blocked disallowed report expression method: execute on java.lang.String
        ...
        ERROR 19 Aug 2026 22:43:49 org.joget.plugin.enterprise.JasperReportsMenu - {"thread":"http-nio-8080-exec-7","message":"","params":{},"url":"http://localhost:8080/jw/web/ubuilder/app/expenseclaim/3/home/page/template","username":"admin"}
        net.sf.jasperreports.engine.fill.JRExpressionEvalException: Error evaluating expression for source text: "touch /tmp/jasper_rce_poc_marker.txt".execute().waitFor().toString()
        ...
        Caused by: java.lang.SecurityException: Method 'execute' is not allowed in report expressions
        	at org.joget.aspect.jasperreports.GroovyReportMethodGuardAspect.deny(GroovyReportMethodGuardAspect.java:90)

        If the above errors are not visible in the logs, it means that the hotfix implementation was not successful.

      • As an additional verification step, check the intended target folder and make sure the text file is not created there. In this example, check if /tmp/jasper_rce_poc_marker.txt is not created.

Option B: Block Access to JasperReports web service endpoint (If the hotfix is not applied)

Please follow the steps below:

If you have a WAF/Reverse Proxy, please BLOCK access to the URL ending with:

plugin/org.joget.plugin.enterprise.JasperReportsMenu/service

Sample URL:

http://localhost:8080/jw/web/json/app/expenseclaim/1/plugin/org.joget.plugin.enterprise.JasperReportsMenu/service

Verifying block access

Make the following call. Replace the domain accordingly.

curl -sS -w "\n%{http_code}" -H "Referer: http://localhost:8080/jw" 'http://localhost:8080/jw/web/json/app/test/1/plugin/org.joget.plugin.enterprise.JasperReportsMenu/service?action=report'

Unsuccessful block

You will get the following response with status code 200.

<style>.exportlinks{display:none;}</style>
<h1>Invalid Jasper Report Definition (JRXML)</h1>
<div>
    <p>
        Cause:<br/>java.lang.NullPointerException: Cannot invoke "org.joget.apps.app.model.AppDefinition.getAppId()" because "appDefinition" is null
    </p>
</div>



200%

Successful block

If the access is blocked successfully, you will get the following response with status code 403.

{"error":{"date":"Sat Aug 15 22:19:23 MYT 2026","message":"","code":"403"}}{"error":"Access denied"}

403%

If you are using the aspect plugin, you will see this in the Joget log.

INFO  15 Aug 2026 21:30:36 org.joget.aspect.jasperreportsmenu.JasperReportsMenuPatchAspect - Blocked JasperReportsMenu.webService

If you are using the filter plugin, you will see this in the Joget log.

INFO  15 Aug 2026 22:23:03 org.joget.marketplace.PluginServiceBlockWebFilter - Blocked access to /web/json/app/test/1/plugin/org.joget.plugin.enterprise.JasperReportsMenu/service from 0:0:0:0:0:0:0:1

This section has been preserved as context for the latest hotfix. Do not follow these instructions:

curl -sS -w "\n%{http_code}" -H "Referer: http://localhost:8080/jw" 'http://localhost:8080/jw/web/json/app/test/1/plugin/org.joget.plugin.enterprise.JasperReportsMenu/service?action=report'

<style>.exportlinks{display:none;}</style>
<h1>Invalid Jasper Report Definition (JRXML)</h1>
<div>
    <p>
        Cause:<br/>java.lang.NullPointerException: Cannot invoke "org.joget.apps.app.model.AppDefinition.getAppId()" because "appDefinition" is null
    </p>
</div>



200%

{"error":{"date":"Sat Aug 15 22:19:23 MYT 2026","message":"","code":"403"}}{"error":"Access denied"}

403%

INFO  15 Aug 2026 21:30:36 org.joget.aspect.jasperreportsmenu.JasperReportsMenuPatchAspect - Blocked JasperReportsMenu.webService

INFO  15 Aug 2026 22:23:03 org.joget.marketplace.PluginServiceBlockWebFilter - Blocked access to /web/json/app/test/1/plugin/org.joget.plugin.enterprise.JasperReportsMenu/service from 0:0:0:0:0:0:0:1

May 2024

Denial-of-Service (DoS) in Login Page

Description

On the login page, it is possible to send specially crafted parameters to cause the page to trigger an error subsequently:

NullPointerExceptions e.g.:
 
```
Caused by: java.lang.NullPointerException
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.getParameterNames(ParameterizedAnnotationMethodHandlerAdapter.java:84) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
    at org.glowroot.agent.plugin.servlet.DetailCapture_.captureRequestParameters(DetailCapture.java:71) ~[?:?]
    at org.glowroot.agent.plugin.servlet.RequestParameterAspect$GetParameterAdvice_.captureRequestParameters(RequestParameterAspect.java:61) ~[?:?]
    at org.glowroot.agent.plugin.servlet.RequestParameterAspect$GetParameterAdvice_.onReturn(RequestParameterAspect.java:54) ~[?:?]
    at javax.servlet.ServletRequestWrapper.getParameterMap(ServletRequestWrapper.java:157) ~[servlet-api.jar:4.0.FR]
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.setAttribute(ParameterizedAnnotationMethodHandlerAdapter.java:96) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.<init>(ParameterizedAnnotationMethodHandlerAdapter.java:62) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
```

Once triggered, the login page becomes inaccessible, and the web application server needs to be restarted to restore access.

Severity

High

Affected Versions

Joget DX 8.0.12 and below

Resolution

Upgrade to Joget DX 8.1.0 and above

March 2024

Reflected Cross-Site Scripting Vulnerability (XSS) in Userview

Description

In a userview, it is possible to send unvalidated data to a web browser when dynamically switching user locales, which can result in the browser executing malicious code.

Severity

High

Affected Versions

Joget DX 8.0.11 and below

Resolution

Upgrade to Joget DX 8.0.12 and above

April 2022

Critical Vulnerability in Spring Framework CVE-2022-22965

Description

A critical vulnerability has been found in the Spring Framework. According to the vulnerability report CVE-2022-22965:

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:

• JDK 9 or higher
• Apache Tomcat as the Servlet container
• Packaged as WAR
• spring-webmvc or spring-webflux dependency

Affected Joget Versions

• Joget DX (7.0.27 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below).
• Joget Workflow v6 (6.0.34 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below)

Resolution

A fix is available in the latest Joget versions:

• Joget DX 7.0.28
• Joget Workflow v6 6.0.35

Workarounds

If you are not able to upgrade to the latest Joget versions yet, please perform either one of the following workarounds:

• Upgrade to Apache Tomcat 8.5.78 or 9.0.62, or
• Downgrade to Java 8, or
• Disable the AccessLogValve in Tomcat's server.xml configuration. Edit /conf/server.xml and remove/comment the tag <Valve className="org.apache.catalina.valves.AccessLogValve" .. />

December 2021

Critical Vulnerability in Apache Log4j CVE-2021-44228

Description

Critical vulnerability in Apache Log4j. According to the report CVE-2021-44228:

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected Joget Versions

The following versions use Apache Log4j 1.x:

• Joget DX 7.0.25 and below
• Joget Workflow v6 (all versions)

However, this vulnerability only affects Apache Log4j versions from 2.0-beta9 to 2.14.1, so they are NOT affected by this vulnerability.

Resolution

To upgrade to the latest log4j 2 version, upgrade to the following Joget versions:

• Joget DX 7.0.26 and above