What’s Vulnerable › Vulnerabilities

CVE-2025-66214: Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-09 · updated 2026-10-14
• Weakness: CWE-502

Description

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.

Affected products

• wearefrank ladybug: before 3.0-20251107.114628 — fixed in 3.0-20251107.114628

How to fix

Upgrade to a fixed version: wearefrank ladybug 3.0-20251107.114628. Check the vendor advisory for mitigations.

References

• https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f
• https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f

Get alerted when CVE-2025-66214 or the next vulnerability affects your stack