CVE-2026-17595

LowCVSS 2.7/10Last modified Sep 22, 2026

Description

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Aug 7, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-175966.1Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobsto CVE-2026-175972.7Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holdi CVE-2026-175984.9Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating CVE-2026-175997.2Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not CVE-2026-17605.3A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine CVE-2026-176008.8Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's CVE-2026-176017.2A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant br CVE-2026-176024.9The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a CVE-2026-176038.8Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration CVE-2026-176044.9The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up CVE-2026-176056.6The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all version CVE-2026-176076.5The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortc