Hitachi Pentaho Business Analytics Server versions 8.3.x prior to 9.3.0.2 or 9.4.x prior to 9.4.0.1 suffer from a remote code execution vulnerability. An attacker can exploit this issue by sending a specially crafted HTTP request to the affected application. A successful exploit could allow the attacker to execute arbitrary code on the target system.

Pentaho Business Server versions prior to 9.4.0.1 / 9.3.0.2 contain security restrictions using non-canonical URLs that can be bypassed. This bypass may be associated with a vulnerability allowing certain Web services to define property values containing Spring templates which are then interpreted (Server-Side Template Injection).

ID	Name	Product	Family	Published	Updated	Severity
114985	Hitachi Pentaho Business Analytics Server 8.3.x < 9.3.0.2 / 9.4.x < 9.4.0.1 Remote Code Execution	Web App Scanning	Component Vulnerability	10/3/2025	10/3/2025	critical
114248	Pentaho Business Server Server-Side Template Injection	Web App Scanning	Component Vulnerability	4/9/2024	4/9/2024	high

Detections

Analytics

Plugins Search

critical

high