{"id":"CVE-2025-11158","aliases":["EUVD-2025-208457","GHSA-qc5v-wjx7-7367"],"status":"published","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Missing Authorization","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00422,"percentile":0.36957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-03-09T22:12:51Z","modified":"2026-06-17T08:29:46Z","products":[{"vendor":"hitachi","product":"vantara_pentaho_data_integration_and_analytics"},{"vendor":"hitachi vantara","product":"pentaho data integration and analytics"}],"references":[{"url":"https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Missing-Authorization-Versions-before-10-2-0-6-impacted-CVE-2025-11158","tags":["vendor-advisory","Third Party Advisory"]},{"url":"https://www.ox.security/blog/cve-2025-11158/","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11158"},{"url":"https://www.ox.security/blog/cve-2025-11158"},{"url":"https://github.com/advisories/GHSA-qc5v-wjx7-7367"}],"sources":{"cve":[{"id":"CVE-2025-11158","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Missing Authorization","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.","status":"published","published":"2026-03-09T22:12:51.587Z","modified":"2026-03-10T18:42:40.262Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-208457","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.","status":"published","published":"2026-03-09T22:12:51Z","modified":"2026-03-10T18:42:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:04.718931Z"}],"ghsa":[{"id":"GHSA-qc5v-wjx7-7367","title":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x...","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.","status":"published","published":"2026-03-10T18:31:16Z","modified":"2026-03-10T21:32:14Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:06:33.229996Z"}],"nvd":[{"id":"CVE-2025-11158","description":"Hitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.","status":"published","published":"2026-03-10T16:23:22.56Z","modified":"2026-06-17T08:29:46.287Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}