CVE-2025-66214

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.

• CWE-502

• https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398fExploit, Vendor Advisory
• https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398fExploit, Vendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66209Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-6621A vulnerability classified as critical has been found in TOT…9.8
• CVE-2025-66210Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66211Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66212Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66213Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-66215OpenSC is an open source smart card tools and middleware. Pr…6.8
• CVE-2025-66216AIS-catcher is a multi-platform AIS receiver. Prior to versi…9.8
• CVE-2025-66217AIS-catcher is a multi-platform AIS receiver. Prior to versi…7.5
• CVE-2025-66219willitmerge is a command line tool to check if pull requests…9.8
• CVE-2025-66220Envoy is a high-performance edge/middle/service proxy. In 1.…7.1
• CVE-2025-66221Werkzeug is a comprehensive WSGI web application library. Pr…5.3