PT-2026-1866 · H2Database+1 · H2 Jdbc Driver+1

Published 2026-01-08 · Updated 2026-01-09 · CVE-2025-66913

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JimuReport versions through 2.1.3

Description The software is susceptible to remote code execution when handling user-supplied H2 JDBC URLs. The application directly passes the attacker-controlled JDBC URL to the H2 driver, enabling the use of specific directives to execute arbitrary Java code. The vulnerability involves the processing of H2 JDBC URLs and allows for the execution of code on the system. The vulnerable component is the H2 JDBC driver. The vulnerable parameter is the JDBC URL itself.

Recommendations Versions prior to 2.1.3 are affected. Update JimuReport to a version later than 2.1.3. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-66913

Affected Products

H2 Jdbc Driver

Jimureport

References · 9

• https://github.com/jeecgboot/jimureport/issues/4306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66913 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66913 · Vendor Advisory
• https://twitter.com/CVEnew/status/2009462375267881279 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009362058563997854 · Twitter Post
• https://gist.github.com/Catherines77/f15d53e9705b24cf018e5bffed3e8234 · Note
• https://twitter.com/CveFindCom/status/2009364279904858359 · Twitter Post
• https://t.me/CVEtracker/41764 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009457132979028339 · Twitter Post