CVE-2025-11158

A user with access to the system can publish a new PRPT report containing an embedded, malicious Groovy script. The platform does not verify or restrict the contents of such scripts before execution (CWE-862: missing authorization). When the report is processed, the script is executed in the server context, allowing the attacker to execute arbitrary system commands.

The attacker can gain full control over the server, including reading and modifying sensitive data, installing malicious software, or leveraging the compromised system for further attacks on the infrastructure (lateral movement). The scope of the vulnerability covers full confidentiality, integrity, and availability of the system.

The software must be updated to version 10.2.0.6 or later. Details regarding the patch are available in the official security notice from the vendor at the address indicated in the references.

Hitachi Vantara Pentaho Data Integration & Analytics in versions before 10.2.0.6, including branches 9.3.x and 8.3.x