CVE-2025-66913 Code injection in n/a
Attackers can execute arbitrary Java code by supplying malicious H2 JDBC URLs to the JimuReport application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66913?
CVE-2025-66913 is a critical code injection vulnerability in n/a, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
Weakness: CWE-94
Which versions are affected by CVE-2025-66913?
It affects 1 product.
Products include Jeecg Jimureport.
How do I fix CVE-2025-66913?
No fix has been published for CVE-2025-66913 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-66913 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66913 exists.
Other vulnerabilities in n/a
- CVE-2024-44893 Privilege escalation in n/a
- CVE-2023-6307 jeecgboot JimuReport image path traversal
- CVE-2023-4450 jeecgboot JimuReport Template injection
- CVE-2025-10770 jeecgboot JimuReport MySQL JDBC testConnection deserialization
- CVE-2025-10771 jeecgboot JimuReport DB2 JDBC testConnection deserialization
Sources
Also known as GHSA-4993-v2g9-96m4.