CVE-2025-66913
CriticalSummary
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
Risk Assessment
The risk includes the possibility of remote code execution on the server, which can lead to full system compromise, data theft, or service disruption.
Recommendation
It is recommended to immediately upgrade JimuReport to a version later than 2.1.3 and avoid processing untrusted JDBC URLs.
Original NVD description (English source)
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.