Remote Code Execution Vulnerability in JimuReport by Jeecg Boot
CVE-2025-66913

9.8CRITICAL

Key Information:

Vendor

Jeecg Boot

Status
JimuReport
Vendor
CVE Published:
8 January 2026

What is CVE-2025-66913?

JimuReport versions prior to 2.1.3 are susceptible to a remote code execution vulnerability due to improper handling of user-supplied H2 JDBC URLs. This flaw permits attackers to craft malicious JDBC URLs that are processed directly, enabling the execution of arbitrary Java code within affected instances of the application. It is crucial for users of JimuReport to apply the latest updates to safeguard against potential exploitation of this vulnerability.

References

https://github.com/jeecgboot/jimureport/issues/4306
https://gist.github.com/Catherines77/f15d53e9705b24cf018e...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.