Pentaho Data Integration CVE-2025-11159

Requires an authenticated data-source administrator to create a NEW database connection whose JDBC URL points to an H2 database and carries an attacker-controlled INIT/RUNSCRIPT parameter; the vulnerable bundled H2 JDBC driver then runs the supplied script at connection time. Limiting factors: exploitation is gated behind high-privilege data-source-admin rights (PR:H) - this is effectively privileged feature abuse, coercion, or an insider-threat vector rather than unauthenticated remote attack. No end-user interaction beyond the admin's own connection-creation action is needed. Affects all Pentaho Data Integration & Analytics versions prior to 10.2.0.7 and 11.0.0.0; upgrading to fixed releases remediates.

Signals converge on a genuine but high-barrier issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) pairs a high-privilege prerequisite (PR:H) with total technical impact, which the SSVC framework corroborates (Technical Impact: total). However, exploitation signals are quiet: SSVC Exploitation is 'none', EPSS is only 0.07% (20th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. The realistic reading is that this is a legitimately serious code-execution primitive gated behind data-source-administrator privileges rather than a mass-exploitation candidate - a privileged-abuse / post-compromise or insider-threat risk, not an internet-facing pre-auth emergency. One metadata conflict to flag: the 'Information Disclosure' tag understates and mislabels the impact - the description states external SCRIPT EXECUTION and the vector carries I:H/A:H, so this is code execution, not mere disclosure. CWE-1395 (dependency on a vulnerable third-party component, the H2 JDBC driver) confirms the root cause is a bundled component rather than Pentaho-specific logic.

A user with data-source-administrator rights in Pentaho creates (or is socially engineered/coerced into creating) a new JDBC connection to an H2 database using a crafted connection URL that embeds an INIT/RUNSCRIPT clause. When Pentaho establishes the connection through the vulnerable H2 driver, the attacker-supplied SQL/script executes on the server, yielding code execution in the Pentaho process context. No public exploit is identified for this CVE specifically, though the underlying H2 JDBC INIT-script technique is well documented and trivially reproducible.