PT-2025-45450 · Apache+2 · Jakarta.El.Elprocessor+3

Published 2025-11-07 · Updated 2025-11-12 · CVE-2025-63690

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pig-mesh versions 3.8.2 and below

Description The software contains a flaw that allows for remote code execution. Specifically, when configuring scheduled tasks within the Quartz management function, located in the system management module, it’s possible to execute arbitrary Java classes possessing a parameterless constructor and methods accepting a String parameter through reflection. This can be leveraged to execute commands using the eval method within Tomcat’s jakarta.el.ELProcessor class. The vulnerability arises from the ability to execute any Java class with a parameterless constructor and its methods with a String type parameter through reflection.

Recommendations Versions prior to 3.8.2 should be updated.

Exploit

Fix

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2025-63690

Affected Products

Quartz

Apache Tomcat

Jakarta.El.Elprocessor

Pig-Mesh

References · 5

• 🔥 https://github.com/LockeTom/vulnerability/blob/main/md/pig_Remote_Code_Execution_Vulnerability.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63690 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63690 · Vendor Advisory
• https://github.com/pig-mesh/pig/issues/1199 · Note
• https://twitter.com/cracbot/status/1988562470219489461 · Twitter Post