CVE-2025-10771 jeecgboot JimuReport DB2 JDBC testConnection deserialization

What is CVE-2025-10771?

CVE-2025-10771 is a medium-severity unsafe deserialization vulnerability in jeecgboot JimuReport, published on 21 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Weakness: CWE-502, CWE-20

Which versions are affected by CVE-2025-10771?

It affects 1 product.

Products include Jeecg Jimureport.

How do I fix CVE-2025-10771?

No fix has been published for CVE-2025-10771 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-10771 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10771 exists.

Other vulnerabilities in jeecgboot JimuReport

• CVE-2025-66913 Code injection in n/a Critical 9.8
• CVE-2024-44893 Privilege escalation in n/a Critical 9.8
• CVE-2023-6307 jeecgboot JimuReport image path traversal Medium 6.3
• CVE-2023-4450 jeecgboot JimuReport Template injection Medium 6.3
• CVE-2025-10770 jeecgboot JimuReport MySQL JDBC testConnection deserialization Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5vxh-cm9f-9j4r.