CVE-2025-12305 is a Medium severity (CVSS 6.3) deserialization flaw in quequnlong shiyi-blog, up to and including 1.2.1. The Job Handler in SysJobController.java is affected. No fixed version is confirmed, so restrict access to job features and check the project for a newer release.
What's affected
The record names shiyi-blog up to 1.2.1, a Java blog system. The affected code is in src/main/java/com/mojian/controller/SysJobController.java, part of the Job Handler component. The record says the attack can be run remotely and that the exploit has been made public.
Weakness classes: CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data).
The vector says the attacker needs a low-privilege account, which is why the score is medium. No fixed version is named in the record, so check the project repository or release page for anything newer than 1.2.1.
How to check if you're exposed
- Find out whether shiyi-blog is deployed anywhere. Search your repositories and build files for the project name or the package com.mojian.
- For each deployment, check the version. The record covers every release up to 1.2.1.
- Check whether the scheduled job management feature is reachable, and who holds accounts that can use it.
- Review application logs for job creation or change events you do not recognize.
If you build the app from source, run a dependency scan over its build file as well. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, which helps you see the other libraries the app pulls in.
What to do now
- Check the project for a release newer than 1.2.1 and upgrade after testing, if one exists.
- Limit access to the admin area and the job management feature to a small set of trusted accounts and a trusted network.
- Turn on multi-factor authentication where the app or your reverse proxy supports it.
- Use a serialization filter or an allowlist of accepted classes where the code reads serialized data.
- If no fix exists, consider replacing the app or removing the job feature.
Why it matters
Deserialization of untrusted data turns bytes sent by a user back into objects inside the application. If the program does not control which object types it accepts, the data can steer behavior the developer never planned. In Java, this class of bug has a long record of serious results, which is why filters and allowlists are standard advice.
The record also lists improper input validation as a related weakness. The public report is titled as a remote code execution issue, but the score is medium because of the privileges required. The CVE is not in the CISA KEV catalog and the record does not report exploitation in the wild.
Quick check
Why is this only medium if it can run code?
The score vector requires an account with high privileges, which lowers the rating. Still treat admin accounts for this app as high value.
Sources
- Safeguard Gold entry for CVE-2025-12305
- NVD record for CVE-2025-12305 (published 27 October 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://github.com/dongodid/cve-sub/blob/main/shiyi-blog/RCE.md
- https://vuldb.com/?ctiid.329977
- https://vuldb.com/?id.329977
- https://vuldb.com/?submit.676725
- https://vuldb.com/?submit.676730
Last reviewed: 19 October 2026.
