CVE-2025-10771 is a medium severity (CVSS 6.3) insecure deserialization flaw in jeecgboot JimuReport up to 2.1.2, through the DB2 JDBC handler at /drag/onlDragDataSource/testConnection. The record lists no fixed version. Upgrade only to a release the vendor confirms, and restrict who can reach this endpoint.
What's affected
Affected: JimuReport up to 2.1.2, per the record. The weakness is in /drag/onlDragDataSource/testConnection, where the clientRerouteServerListJNDIName argument is handled by the DB2 JDBC handler. The record says it can be reached remotely and that an exploit has been published.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It needs network access and a low privilege account but no user interaction, and it rates low impact across confidentiality, integrity and availability. Real impact of deserialization can be higher than the score suggests, depending on what libraries are on the class path.
The GitHub issue linked from the record says the report concerns JimuReport up to 2.1.2 and a DB2 data source test. It describes a parameter that can cause a lookup against an outside server. The issue is marked closed, but the page we read names no fixed version, patch or commit. The advisory should be checked directly before you assume a given release is fixed.
Fixed versions: none confirmed in the record. Check the project's release notes and issue tracker before you trust a version number. The weakness classes are CWE-502 (deserialization of untrusted data) and CWE-20 (improper input validation).
How to check if you're exposed
You can check this with the package manager or the running service.
- Find the version. For a Java service, look at the jar name or the build file, for example
find / -name "*jimureport*.jar" 2>/dev/nulland read the version from the file name or manifest. - Compare it with the affected range above (JimuReport up to 2.1.2).
- Check whether the named endpoint,
/drag/onlDragDataSource/testConnection, is reachable from outside the trusted network. A reverse proxy log search for that path shows who has been calling it. - List who holds an account that can use the data source or import feature, since the record says a low privilege account is enough.
- Look at outbound traffic from the host for connections to unexpected hosts, which can show unwanted driver or lookup activity.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses.
What to do now
- Confirm your version against the affected range and note which environments run it.
- Block external access to
/drag/onlDragDataSource/testConnectionat the reverse proxy or firewall unless a real user needs it. - Reduce who can create or test data source connections. Treat that ability as a privileged one.
- Check the project's release notes or issue tracker for a fixed build, and upgrade only to one the vendor names. The record says the vendor response is not stated; the linked issue was closed without naming a fix.
- Restrict outbound network access from the host so that it cannot reach arbitrary servers.
- Where you can, limit which JDBC drivers and connection options the application accepts, and review existing data source entries for ones nobody recognises.
- Add this CVE to your tracker so the answer is reviewed again when the vendor responds.
Why it matters
Deserialization flaws happen when an application rebuilds objects from data an outsider controls. If the data names something unexpected, the application may run behaviour that its authors never intended. Here the input is a connection string that a database driver processes, which shows how data source settings can become an attack surface.
The record does not mark this CVE as known exploited (the KEV flag is false), but it does say a public exploit exists. A medium score can understate things when a feature is reachable by users who should not have it, so reachability of the endpoint is the question to answer first.
Quick check
Is there a fixed version for CVE-2025-10771?
The record lists none. Check the vendor project directly and confirm any fix in release notes.
Does the medium score mean I can delay?
No. The score assumes a low privilege account and low impact, but the record says a public exploit exists. Restrict the endpoint first, then plan the upgrade.
Sources
Last reviewed: 19 October 2026.
