Description

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T04:18:00.433Z",
  "pubdate": "2026-09-01T04:18:00.433Z",
  "executiveSummary": "A deserialization vulnerability exists in jackson-databind that allows an attacker to influence the selection and instantiation of java.nio.file.FileSystemProvider through untrusted JSON input.\nThe vulnerability resides in the deserializer for java.nio.file.Path, which fails to enforce strict validation on URI schemes provided during the deserialization process.\nBy crafting a malicious JSON payload, an attacker can trigger the resolution of arbitrary URIs. If a third-party FileSystemProvider with side-effecting behavior is present on the application classpath, the attacker can force the application to interact with it, potentially leading to unauthorized operations, unexpected resource access, or class loading of arbitrary providers.\nThis vulnerability affects both com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind across various versions ranging from 2.8.0 up to 3.2.2.\nThe risk is primarily contingent upon the presence of third-party FileSystemProvider implementations within the environment. If only default JDK providers (file, jar/zipfs) are present, the immediate impact is limited; however, the potential for remote exploitation depends on the security posture of libraries present on the classpath.",
  "technicalDetails": "The root cause of this vulnerability is located in JDKFromStringDeserializer.NioPathHelper.deserialize. During the deserialization of a java.nio.file.Path object, the component accepts a string from untrusted JSON, passes it to the new URI(value) constructor, and subsequently supplies it to Path.of(uri).\nThe application attempts to resolve this URI using available FileSystemProvider instances. When Path.of(uri) encounters a scheme that does not correspond to an immediately accessible filesystem, it throws a FileSystemNotFoundException. The deserializer then proceeds to iterate through the available providers via ServiceLoader<FileSystemProvider>. It calls provider.getPath(uri) on the first provider that claims the attacker-specified URI scheme.\nThis logic enables an attacker to force the application to invoke specific FileSystemProvider methods by injecting a JSON payload that specifies a target URI scheme. Because the deserializer does not validate the scheme against an allowlist, the application effectively acts as an oracle that invokes registered providers on behalf of the attacker.\nThe attack flow proceeds as follows: 1) The attacker transmits a serialized JSON object containing a path string with a specific URI scheme. 2) The jackson-databind deserializer invokes JDKFromStringDeserializer.NioPathHelper.deserialize. 3) The code instantiates a URI from the attacker-supplied string. 4) The application attempts to locate a matching FileSystemProvider. 5) If a third-party provider is found on the classpath that handles the requested scheme, the provider's getPath method is executed with the attacker-controlled input. 6) The side effects of this provider (e.g., file operations, network requests, or resource instantiation) are triggered within the context of the running application.\nThe vulnerability is technically significant because it triggers the loading of provider classes, which can be leveraged for further attacks or to bypass security constraints. The scope of impact is highly dependent on the library ecosystem; if a vulnerable FileSystemProvider is included in the project, the deserialization mechanism can be abused to perform unauthorized file system interaction or potentially achieve remote code execution depending on the specific capabilities of the hijacked provider.\nAffected versions for com.fasterxml.jackson.core:jackson-databind are: 2.8.0 through 2.18.9, 2.19.0 through 2.21.5, and 2.22.0 through 2.22.1. Affected versions for tools.jackson.core:jackson-databind are: 3.0.0 through 3.1.5, and 3.2.0 through 3.2.1."
}