Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2025-11158: Hitachi Vantara Pentaho: Unrestricted Scripts in Reports Allow Remote Code Execution
CVE-2025-11158 · published 7 months ago
Summary
Pentaho Data Integration & Analytics versions before 10.2.0.6 allow users to insert malicious code into reports, which can lead to unauthorized access to your system and data. This means attackers could potentially break into your system and take control of it. Update to version 10.2.0.6 or later to fix this issue.
Original advisory text
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion o...
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-862Missing Authorization
Timeline
Published10 Mar 2026
Updated4 Nov 2026
First seen10 Mar 2026
Sources
CVE-2025-11158 · NVD
Track software like this
Free during beta