CVE-2025-66214

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.0

EPSS

0.32%

Published

Dec 9, 2025

Modified

Dec 17, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Weaknesses (CWE)

CWE-502

Affected Products (1)

wearefrank · ladybug (up to 3.0-20251107.114628)vulnerable

References (2)

https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f

ExploitVendor Advisory

https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f

ExploitVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs