Hutool allows remote code execution (RCE) via the QLExpressEngine class

MOYENNE 6.5CVE-2025-56769 · GHSA-gcfh-36x4-mgj6 · Published 25/09/2025 · updated 17/06/2026

En bref

CVE-2025-56769 est une vulnérabilité MOYENNE (CVSS 6.5) touchant cn.hutool:hutool-extra, hutool (hutool).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.6% des vulnérabilités.
Correctif : mettre à jour vers 5.8.40 ou plus récent.

Package	Affected versions	Patched versions
cn.hutool:hutool-extra Maven	`< 5.8.40`	`5.8.40`
hutool hutool	`< 5.8.40`	`5.8.40`

Description

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

NVD description

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

References

nvd.nist.gov/vuln/detail/CVE-2025-56769 · ADVISORY
chinabugotech/hutool · WEB
chinabugotech/hutool commit 3d0d8de · WEB
chinabugotech/hutool · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free