PT-2025-51323 · Pentaho+1 · Analytics Community Dashboard Editor Plugin+1

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-9121

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions 8.3.x and 9.3.0.x through 10.1.9.x

Description The software deserializes untrusted JSON data without restricting the parser to approved classes and methods.

Recommendations Update to version 10.2.0.4 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-9121

Affected Products

Analytics Community Dashboard Editor Plugin

Pentaho Data Integration

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9121 · Security Note
• https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121 · Note
• https://twitter.com/CveFindCom/status/2000712289083707539 · Twitter Post
• https://t.me/cveNotify/145874 · Telegram Post
• https://twitter.com/TheHackerWire/status/2000718688987832446 · Twitter Post
• https://t.me/CVEtracker/39874 · Telegram Post
• https://twitter.com/CVEnew/status/2002857355202253060 · Twitter Post