Threats affecting pkg:maven/org.apache.commons/commons-beanutils

CVE-2025-48734 is a high-severity improper access control vulnerability in Apache Commons BeanUtils 1.x before version 1.11.0 and 2.x before 2.0.0-M2. It allows attackers to access the class loader of Java enum objects via the 'declaredClass' property when property paths from external sources are passed directly to PropertyUtilsBean.getProperty() or getNestedProperty(). This vulnerability can lead to arbitrary code execution.