CVE-2025-11158: Pentaho Data Integration RCE Vulnerability

CVE-2025-11158 Overview

CVE-2025-11158 is a critical Remote Code Execution (RCE) vulnerability affecting Hitachi Vantara Pentaho Data Integration & Analytics. The vulnerability stems from missing authorization controls that fail to restrict Groovy scripts in new PRPT (Pentaho Reporting) reports published by users. This allows authenticated attackers with high privileges to insert arbitrary scripts into reports, leading to remote code execution on the underlying server.

Critical Impact

Authenticated attackers can achieve full remote code execution by injecting malicious Groovy scripts into PRPT reports, potentially compromising the entire Pentaho server and any connected data sources.

Affected Products

• Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6
• Hitachi Vantara Pentaho Data Integration & Analytics 9.3.x series
• Hitachi Vantara Pentaho Data Integration & Analytics 8.3.x series

Discovery Timeline

• 2026-03-10 - CVE-2025-11158 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-11158

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating a fundamental access control failure in the Pentaho platform's report handling mechanism. The platform's PRPT report publishing functionality allows users to embed Groovy scripts within reports. However, the application fails to properly authorize or restrict the execution of these embedded scripts, creating a pathway for arbitrary code execution.

The vulnerability is network-exploitable, meaning attackers can target the system remotely without requiring physical access. While high privileges are required to exploit this flaw, successful exploitation has a changed scope, allowing the attacker to affect resources beyond the vulnerable component's security authority. This includes full compromise of confidentiality, integrity, and availability of the target system.

Root Cause

The root cause of CVE-2025-11158 lies in missing authorization checks within the PRPT report publishing workflow. When users publish new reports containing Groovy scripts, the Pentaho platform does not adequately validate or restrict the script content. Groovy, being a powerful JVM-based scripting language, provides direct access to Java APIs and system resources. Without proper script sandboxing or content authorization, malicious users can craft reports containing Groovy code that executes arbitrary commands on the server when the report is processed or rendered.

Attack Vector

The attack leverages the legitimate PRPT report publishing feature in Pentaho Data Integration & Analytics. An attacker with authenticated access and sufficient privileges to publish reports can craft a malicious PRPT file containing embedded Groovy scripts. These scripts can include arbitrary Java code that executes system commands, reads sensitive files, establishes reverse shells, or performs other malicious operations.

The attack flow typically involves:

1. An authenticated user with report publishing privileges creates a new PRPT report
2. The attacker embeds malicious Groovy script code within the report structure
3. Upon report upload or when the report is rendered/processed, the Groovy script executes
4. The script runs with the privileges of the Pentaho server process, potentially allowing full system compromise

For technical details on the exploitation mechanism, refer to the Ox Security Blog analysis.

Detection Methods for CVE-2025-11158

Indicators of Compromise

• Unusual PRPT report uploads containing embedded Groovy scripts from non-administrative users
• Unexpected process spawning from the Pentaho server process (e.g., shell commands, network utilities)
• Anomalous outbound network connections originating from the Pentaho application server
• Log entries showing report processing errors related to script execution failures
• Presence of unfamiliar or suspicious PRPT files in the Pentaho repository

Detection Strategies

• Monitor Pentaho server logs for Groovy script execution events, particularly in report processing contexts
• Implement file integrity monitoring on the Pentaho repository directories to detect unauthorized report modifications
• Deploy endpoint detection and response (EDR) solutions to identify suspicious child processes spawned by the Pentaho Java process
• Utilize network detection tools to identify unusual traffic patterns from Pentaho servers, including reverse shell connections

Monitoring Recommendations

• Enable detailed audit logging for all report publishing and modification activities in Pentaho
• Configure SIEM alerts for patterns matching Groovy script execution or command injection attempts
• Monitor authentication logs for privileged account activity related to report management functions
• Implement behavioral analysis to detect deviations from normal report publishing patterns

How to Mitigate CVE-2025-11158

Immediate Actions Required

• Upgrade Hitachi Vantara Pentaho Data Integration & Analytics to version 10.2.0.6 or later immediately
• Conduct an audit of all recently published PRPT reports to identify potentially malicious content
• Review and restrict user permissions for report publishing capabilities to trusted administrators only
• Implement network segmentation to limit the blast radius if the Pentaho server is compromised
• Enable comprehensive logging to assist in forensic analysis if exploitation is suspected

Patch Information

Hitachi Vantara has released version 10.2.0.6 which addresses this vulnerability by implementing proper authorization controls for Groovy script execution in PRPT reports. Organizations running affected versions (any version before 10.2.0.6, including 9.3.x and 8.3.x series) should upgrade immediately.

For detailed patch information and upgrade instructions, refer to the Pentaho Security Advisory.

Workarounds

• Restrict report publishing privileges to only essential, trusted administrative users until patching is complete
• Implement application-level firewall rules to filter requests containing Groovy script indicators
• Disable or block PRPT report functionality temporarily if business operations permit
• Deploy web application firewall (WAF) rules to detect and block malicious script payloads in report uploads
• Consider running the Pentaho server with reduced privileges and in an isolated network segment

If immediate patching is not feasible, work with your security team to implement compensating controls while planning the upgrade path. Review user access controls using Pentaho administration tools to ensure report publishing capabilities are appropriately restricted.