Hutool allows remote code execution (RCE) via the QLExpressEngine class

MITTEL 6.5CVE-2025-56769 · GHSA-gcfh-36x4-mgj6 · Published 25/09/2025 · updated 17/06/2026

Kurz gesagt

CVE-2025-56769 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in cn.hutool:hutool-extra, hutool (hutool).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.34%, höher als bei 27.6% aller Schwachstellen.
Abhilfe: auf 5.8.40 oder neuer aktualisieren.

Package	Affected versions	Patched versions
cn.hutool:hutool-extra Maven	`< 5.8.40`	`5.8.40`
hutool hutool	`< 5.8.40`	`5.8.40`

Description

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

NVD description

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

References

nvd.nist.gov/vuln/detail/CVE-2025-56769 · ADVISORY
chinabugotech/hutool · WEB
chinabugotech/hutool commit 3d0d8de · WEB
chinabugotech/hutool · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free