PT-2025-39463 · Hutool · Hutool

Adv851

·

CVE-2025-56769

·

Published

2025-09-25

·

Updated

2025-10-03

CVSS v4.0

8.9

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions hutool versions prior to 5.8.4
Description An issue exists in the QLExpressEngine class that allows attackers to execute arbitrary expressions, potentially leading to arbitrary method invocation and remote code execution (RCE).
Recommendations Update to a version newer than 5.8.4.

Exploit

Fix

RCE

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-917CWE-77

Related Identifiers

CVE-2025-56769
GHSA-GCFH-36X4-MGJ6

Affected Products

Hutool