CVE-2025-11158

Published: Mar 10, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: security.vulnerabilities@hitachivantara.com (Secondary)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

Affected (1)

Products: Hitachi: Vantara Pentaho Data Integration And Analytics

Hitachi

1 product

Vantara Pentaho Data Integration And Analytics

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho Data Integration And Analytics	Before 10.2.0.6

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Missing-Authorization-Versions-before-10-2-0-6-impacted-CVE-2025-11158

Source: security.vulnerabilities@hitachivantara.com

Third Party Advisory

https://www.ox.security/blog/cve-2025-11158/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.