Vulnerability Description
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pig4Cloud | Pig | <= 3.8.2 |
Related Weaknesses (CWE)
References
- https://github.com/LockeTom/vulnerability/blob/main/md/pig_Remote_Code_ExecutionExploitThird Party Advisory
- https://github.com/pig-mesh/pig/issues/1199Broken Link
FAQ
What is CVE-2025-63690?
CVE-2025-63690 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a paramete...
How severe is CVE-2025-63690?
CVE-2025-63690 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-63690?
Check the references section above for vendor advisories and patch information. Affected products include: Pig4Cloud Pig.