CVE-2025-11158 - Vulnerability Analysis

Overview

Hitachi Vantara Pentaho Data Integration & Analytics < 10.2.0.6 contains a remote code execution caused by unrestricted Groovy scripts in new PRPT reports, letting attackers execute arbitrary scripts remotely, exploit requires report publishing privileges.

Severity & Score

Impact

Attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Mitigation

Update to version 10.2.0.6 or later.

References

• https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Missing-Authorization-Versions-before-10-2-0-6-impacted-CVE-2025-11158
• https://www.ox.security/blog/cve-2025-11158/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 10, 2026

🔴 CVE-2025-11158 - Critical (9.1) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11158/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner