CVE-2025-13805

LowCVSS 3.7

Published: 01/12/2025(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Vulnerability in nutzam NutzBoot up to 2.6.0-SNAPSHOT, affecting the getInputStream function in nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the LiteRpc-Serializer component, leading to deserialization. The attack can be launched remotely but is difficult to exploit.

Risk Assessment

A remote attack could lead to insecure deserialization, potentially enabling code execution or other unauthorized actions.

Recommendation

Update NutzBoot to a version newer than 2.6.0-SNAPSHOT if available, or apply other mitigations.

Other vulnerabilities in NutzBoot

CVE-2025-13804Medium
A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. An unknown function in the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the Ethereum Wallet Handler component allows manipulation, resulting in information disclosure. The attack may be initiated remotely, and the exploit has been released to the public.

Original NVD description (English source)

A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing a manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS