CVE-2025-11158 — Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization

CVE-2025-11158

Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization PUBLISHED

Description (CNA)

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

Affected (CNA)

Vendor / product	Versions
Hitachi Vantara / Pentaho Data Integration and Analytics	affected 1.0 through 9.3.*; affected 10.0 before 10.2.0.6

CWE

CWE-862

References

https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Missing-Authorization-Versions-before-10-2-0-6-impacted-CVE-2025-11158

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://www.ox.security/blog/cve-2025-11158/