CVE-2025-66913 Details
Description
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
A remote code execution vulnerability exists in JimuReport versions through 2.1.3. The issue arises because the application does not validate user-controlled H2 JDBC URLs before passing them to the H2 driver. This oversight allows attackers to inject JDBC URLs with specific directives that can execute arbitrary Java code. Exploitation can be achieved by using the 'INIT' or 'CREATE ALIAS' directives to run malicious Java code on the server.
Users are advised to update to the latest version of JimuReport, as this vulnerability has been fixed in a version that is pending release.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Catherines77/f15d53e9705b24cf018e5bffed3e8234 | [email protected] | Third Party Advisory |
| https://github.com/jeecgboot/jimureport/issues/4306 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jeecg jimureport | <= 2.1.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 30, 2026 | Initial Analysis | [email protected] |
| Jan 8, 2026 | New CVE Received | [email protected] |
| Jan 8, 2026 | CVE Modified | CISA-ADP |