Home / Vulnerability Intelligence / CVE-2025-11159

CVE-2025-11159 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 13, 2026

Hitachi Vantara Pentaho Data Integration & Analytics - Server Side Template Injection

Published: May 13, 2026Updated: May 13, 2026Remote Exploitable

Overview

Hitachi Vantara Pentaho Data Integration & Analytics contains a server side template injection caused by vulnerable JDBC driver for H2 databases, letting data source administrators execute external scripts when creating new connections.

Severity & Score

Severity: Critical

CVSS Score: 9.1

Impact

Data source administrators can execute external scripts, potentially leading to remote code execution on the server.

Mitigation

Update to the latest version of Hitachi Vantara Pentaho Data Integration & Analytics.

References

https://support.pentaho.com/hc/en-us/articles/39954640408077--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Dependency-on-Vulnerable-Third-Party-Component-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2025-11159

Related Resources

Details

CVE ID: CVE-2025-11159
Severity: Critical
CVSS Score: 9.1
Type: template_injection
Status: unconfirmed

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H