#28673 Vulnerability in commons-beanutils (CVE-2025-48734)

Enhancement

Major

#28593

Baumselektions-Modell mit Teilbaum-Selektionslogik

#28695

Selektionsfilter für (Tree-)tables und -grids im Layout-Editor einstellen

#28704

Optimized access to table FLEX_DATA for some DBs

Detail

#28613

"DefaultFor" Konfigurationsoption im "advanceProcess"-Template für BPE

#28679

Dynamic labels for FormTableDefinition

#28705

Close Formlar dialogs on Cancel

#28712

Test can set whether warnings lead to failure

Nice to have

#28588

Option to mark tables in forms as non-selectable

Bugfix

Major

#28673

Vulnerability in commons-beanutils (CVE-2025-48734)

#28675

Opening Excel-Scripts in Script Recorder fails when starting from command line

#28676

Securing Kafka client configuration against SSRF and file reads (CVE-2025-27817)

#28684

DoS vulnerability in Apache Commons FileUpload (CVE-2025-48976)

#28692

ClassCastException in the ActiveTaskComponent

#28700

Security gap in workflow transitions - Unauthorized processing after task completion

#28739

TL script method filterPermission must not be evaluated at compile time

Detail

#28331

Incorrect update type creation in tUpdate leads to ignoring of hidden attribute changes

#28617

Bug: Post-Create-Actions fehlen bei Prozess-Start ohne Prüfung

#28640

Mandatory Multiline fields do not have a blue line

#28665

Calculated attributes are not updated when tables are changed

#28666

Fehlender DisplayContext nach BinaryDataSource-Conversion

#28667

Pipe closed Error when sending mail due to double rendering of content without EncodingAware interface

#28671

ExcelWriter methods are missing

#28686

REST routing: Shorter paths are prioritized over longer paths and cause incorrect route matching

#28690

Create in currency administration has wrong command group

#28698

Executability rule is checked on deleted object

#28706

Form tables exceed container width

#28707

Falsches Dirty-Handling im SelectTransitionDialog (BPE)

#28724

Selection filter must not be evaluated on deleted objects

#28726

Unique-Constraint-Violation bei mehrfacher Anwendung des MoveObjectsProcessor

Nice to have

#28458

Falsche Abfrage, ob Komponente Multi-Selektion unterstützt

Bugfix

Major

#28673

Vulnerability in commons-beanutils (CVE-2025-48734)

JMS SecurityIssue

There is a security vulnerability (CVE-2025-48734) in the currently used version of the commons-beanutils library that could allow attackers to gain access to the ClassLoader. This is done by accessing the declaredClass property in Java enums, which could potentially lead to the execution of arbitrary code.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48734

To fix the problem, the dependency commons-beanutils is now explicitly set to version 1.11.0. In this version, the insecure declaredClass property is deactivated by default.

Test

Check whether the service continues to work properly.