CVE-2025-66214 Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)
Attackers can achieve remote code execution by uploading crafted XML files to Ladybug's report APIs, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66214?
CVE-2025-66214 is a high-severity unsafe deserialization vulnerability in wearefrank ladybug, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.
Weakness: CWE-502
Which versions are affected by CVE-2025-66214?
It affects 1 product.
Products include Wearefrank Ladybug.
How do I fix CVE-2025-66214?
No fix has been published for CVE-2025-66214 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-66214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66214 exists.