CVE-2025-8963 jeecgboot JimuReport Data Large Screen Template testConnection deserialization

What is CVE-2025-8963?

CVE-2025-8963 is a medium-severity unsafe deserialization vulnerability in jeecgboot JimuReport, published on 14 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".

Weakness: CWE-502, CWE-20

Which versions are affected by CVE-2025-8963?

It affects 1 product.

Products include Jeecg Jimureport.

How do I fix CVE-2025-8963?

No fix has been published for CVE-2025-8963 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-8963 being exploited?

There is no known exploitation of CVE-2025-8963 in the wild and no public exploit code.

Other vulnerabilities in jeecgboot JimuReport

• CVE-2025-66913 Code injection in n/a Critical 9.8
• CVE-2024-44893 Privilege escalation in n/a Critical 9.8
• CVE-2023-6307 jeecgboot JimuReport image path traversal Medium 6.3
• CVE-2023-4450 jeecgboot JimuReport Template injection Medium 6.3
• CVE-2025-10770 jeecgboot JimuReport MySQL JDBC testConnection deserialization Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jwrp-6c28-gjv2.