CVE-2025-63690
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function, it is possible to execute any Java class with a parameterless constructor and its methods with a String parameter through reflection. Using the eval method in Tomcat's built-in jakarta.el.ELProcessor class, commands can be executed, leading to remote code execution.
Risk Assessment
An authenticated attacker could execute arbitrary code in the application context, taking control of the server and accessing data.
Recommendation
Update pig-mesh Pig to a version later than 3.8.2 that fixes the vulnerability. Restrict permissions for configuring scheduled tasks to the minimum necessary.
Other vulnerabilities in pig-mesh Pig
See all- CVE-2026-115997Medium
A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.
- CVE-2026-15512Medium
A code injection vulnerability was found in pig-mesh Pig up to version 3.9.2 in the pig-codegen component. The issue affects an unknown functionality of the GeneratorServiceImpl.java file. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS