Ladybug CVE-2025-66214

The target must be running Ladybug (wearefrank/ladybug) at a version prior to 3.0-20251107.114628 with the report storage/upload APIs (/iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload) reachable by the attacker. Per CVSS PR:L, exploitation requires low-level privileges/access to invoke these endpoints rather than fully anonymous access, so authentication requirements beyond 'some low privilege' are not fully detailed in the description and should be confirmed with the vendor. No user interaction is required, and exploitation works against affected default-exposed instances because the endpoints deserialize user-supplied XML content. The primary limiting factors are the low real-world deployment footprint of Ladybug and the need for network reachability to the API plus the low-privilege access level indicated by the CVSS vector.

This is a genuine high-priority vulnerability on technical merits: CWE-502 (unsafe deserialization of untrusted data) leading to Remote Code Execution, with a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating network-reachable, low-complexity exploitation requiring only low-level privileges and no user interaction, with total confidentiality, integrity, and availability compromise. Publicly available exploit code exists, which materially raises the practical threat. However, the signals are not uniformly alarming: the EPSS score is low at 0.33% (24th percentile), indicating the predictive model currently assesses a low probability of observed exploitation in the near term, and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. The combination of 'POC available + low EPSS + no KEV' is characteristic of a technically serious bug in a low-footprint product that is unlikely to see mass, indiscriminate exploitation but is readily exploitable against any exposed, targeted instance. The PR:L metric implies some level of authenticated/low-privilege access is needed to reach the upload APIs, which tempers the 'fully unauthenticated' worst case; this privilege requirement is not elaborated in the description and should be verified against the vendor advisory. Net: real priority for any organization actually running Ladybug, but not a broad internet-wide emergency of the Log4j class.

An attacker with low-privilege access to a Ladybug instance submits a crafted gzip-compressed XML file to the /iaf/ladybug/api/report/{storage} or /iaf/ladybug/api/report/upload endpoint; when the server deserializes the attacker-controlled XML, an embedded payload triggers arbitrary code execution on the host. Because the vector is network-based with low attack complexity and no user interaction (per CVSS), and publicly available exploit code exists, the barrier to weaponization is low for anyone who can reach the API with the required privilege level.