CVE-2025-8963 is a medium severity (CVSS 6.3) deserialization flaw in jeecgboot JimuReport up to 2.1.1. The record says the testConnection endpoint of the data source feature is affected and quotes the vendor as saying the next version has the change. I could not confirm the exact fixed version number, so check the release notes.
The weakness classes are CWE-20, improper input validation, and CWE-502, deserialization of untrusted data.
What's affected
jeecgboot JimuReport, up to and including 2.1.1, per the record. The affected feature is the file /drag/onlDragDataSource/testConnection in the component the record calls Data Large Screen Template. That endpoint belongs to the data source feature, where an administrator tests a database connection before saving it.
The record scores it 6.3 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: reachable over the network, low attack complexity, a low privilege account is needed, no user interaction, and low impact on confidentiality, integrity and availability.
On severity, the record and the issue title do not line up neatly. The record rates it medium with low impacts. The public issue title, which I read on 18 October 2026, is in Chinese and says JimuReport has a PostgreSQL JDBC remote code execution flaw. A remote code execution label usually points to a worse outcome than the low impact ratings suggest. I could not read the issue body, so I cannot say which description is closer to the truth. Treat the NVD score as the formal rating and the issue title as a reason to patch promptly.
On versions, the record says the vendor replied to the GitHub issue with the words "Modified, next version updated". That means a release after 2.1.1 carries a change. It does not name the version. Check the project's releases for the first version after 2.1.1 and read its notes before you decide what counts as fixed.
How to check if you're exposed
JimuReport is usually embedded in a Java application as a dependency, so look at your build.
mvn dependency:tree | grep -i jimureport
gradle dependencies | grep -i jimureport
If the version printed is 2.1.1 or lower, you are in the affected range. Also check whether the report designer or its data source feature is reachable by users who should not have it. The free in-browser dependency scan at gold.safeguard.sh/scan can list the same dependency from a manifest file, and reachability analysis can help show whether your application actually calls the affected path.
What to do now
- Find every application that bundles JimuReport and note the version.
- Move to the first release after 2.1.1 that the project says contains the change, and read its notes.
- Until then, restrict the data source test endpoint so only trusted administrators on trusted networks can reach it.
- Turn off the report designer in production if you do not need it there.
- Limit the outbound network access of the application server, so a connection test cannot reach arbitrary hosts.
- Review the database credentials stored in the data source settings, and rotate any that were exposed to untrusted users.
Why it matters
Deserialization bugs arise when an application rebuilds objects from data it does not control. If the data can influence which classes are built or what they do, the result can go well past the intended feature. The issue title ties this one to a JDBC connection path, where connection settings come from the user and are handed to a database driver. A connection test is meant to be harmless, which is exactly why it often gets less scrutiny than other endpoints.
The input validation class, CWE-20, is the general lesson: treat connection strings and class names that arrive from a request as untrusted, and allow only values you expect. The KEV flag in the record is false, and I found no advisory saying this is exploited in the wild.
Quick check
Is a fix available?
Probably in a release after 2.1.1, since the vendor reply quoted in the record says the next version was updated. I could not confirm which version number, so read the project's release notes.
Why is the severity medium if the issue title says remote code execution?
The NVD style record scores low impacts and needs a low privilege account. The issue title uses stronger language. I could not read the issue body to reconcile them, so patch as if the worse reading could be right.
Sources
- Gold entry for CVE-2025-8963
- Public issue 4010 on GitHub, title read only
- CWE-20 and CWE-502
Last reviewed: 18 October 2026.
