PT-2026-24134 · Hitachi Vantara · Pentaho Data Integration & Analytics

Published 2026-03-09 · Updated 2026-05-06 · CVE-2025-11158

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.6 Hitachi Vantara Pentaho Data Integration & Analytics versions 8.3.x Hitachi Vantara Pentaho Data Integration & Analytics versions 9.3.x

Description The software does not properly restrict Groovy scripts within new PRPT reports published by users. This allows for the insertion of arbitrary scripts, potentially leading to Remote Code Execution (RCE). The issue affects authenticated users.

Recommendations Update to version 10.2.0.6 or later.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11158

Affected Products

Pentaho Data Integration & Analytics

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-11158 · Security Note
• https://support.pentaho.com/hc/en-us/articles/39975058295821--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Missing-Authorization-Versions-before-10-2-0-6-impacted-CVE-2025-11158 · Vendor Advisory
• https://ox.security/blog/cve-2025-11158 · Note
• https://twitter.com/MosheTov/status/2031383966117212468 · Twitter Post
• https://t.me/CVEtracker/46939 · Telegram Post
• https://twitter.com/TheHackerWire/status/2031409460128952516 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031133912844358107 · Twitter Post
• https://t.me/cveNotify/154930 · Telegram Post
• https://t.me/cveNotify/162403 · Telegram Post
• https://twitter.com/CveFindCom/status/2031410082592747784 · Twitter Post