GitHub Advisoryadvisory · Maven

GHSA-gcfh-36x4-mgj6 Hutool allows remote code execution (RCE) via the QLExpressEngine class

HIGH Published 2025-09-26 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-56769
Ecosystem
Maven
Packages
cn.hutool:hutool-extra
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-917
Reviewed
2025-09-26

Affected packages

• Maven cn.hutool:hutool-extra: < 5.8.40 → fixed in 5.8.40

Description

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

Related

Alias · CVE (1)

  • CVE-2025-56769 An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References