CVE-2025-11159: External Script Execution in H2 JDBC Driver

Successful exploitation of CVE-2025-11159 allows an attacker to gain complete control over the affected system. By crafting a malicious JDBC connection request, an attacker can execute arbitrary code within the context of the Pentaho Data Integration & Analytics application. This could lead to data breaches, system compromise, and potentially lateral movement within the network. The impact is particularly severe because the vulnerability is triggered during connection creation, a common and often trusted operation. The ability to execute code on the server hosting Pentaho opens the door to a wide range of malicious activities, including data exfiltration, denial of service, and installation of persistent backdoors. This vulnerability shares similarities with other JDBC injection vulnerabilities where malicious SQL or code can be injected through connection parameters.

1. Reserved2025-09-29
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2025-11159 is to upgrade Pentaho Data Integration & Analytics to a version that includes the patched H2 Database JDBC Driver (version 11.0 or later). If immediate upgrading is not possible, consider restricting access to the data source administrator functionality to trusted users only. Implement strict input validation on all connection parameters to prevent malicious code injection. While not a complete solution, a Web Application Firewall (WAF) configured to inspect JDBC connection requests for suspicious patterns could provide a layer of defense. Monitor Pentaho logs for unusual connection attempts or errors that might indicate exploitation. After upgrading, confirm the fix by attempting to create a new JDBC connection with a potentially malicious payload – it should be rejected.