CVE-2025-70828

HighPublic PoCRCE

Published: 17 February 2026

Published

17 February 2026

Modified

03 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 29.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70828 is a high-severity OS Command Injection (CWE-78) vulnerability in Running-Elephant Datart. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents OS command injection in the JDBC URL parameter by requiring comprehensive input validation mechanisms.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, reporting, and correction of the specific flaw in Datart v1.0.0-rc.3 to eliminate the vulnerability.

AC-6 Least Privilege partial match

prevent

Limits the impact of arbitrary code execution by enforcing least privilege on low-privileged authenticated users exploiting the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The OS command injection vulnerability in the JDBC URL parameter of the public-facing Datart web application (T1190) allows low-privileged authenticated attackers to execute arbitrary OS commands (T1059), enabling privilege escalation to achieve full system RCE (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration

Deeper analysisAI

CVE-2025-70828 is an arbitrary code execution vulnerability affecting Datart version 1.0.0-rc.3. The flaw arises from improper handling of the URL parameter in the JDBC configuration, classified under CWE-78 (OS Command Injection). It received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-17.

An attacker with low privileges, such as an authenticated user, can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables arbitrary code execution on the target system, resulting in high impacts to confidentiality, integrity, and availability.

Advisories and related resources include a GitHub repository at https://github.com/xiaoxiaoranxxx/CVE-2025-70828 detailing the issue and a MySQL Connector/J documentation page at https://dev.mysql.com/doc/connector-j/en/connector-j-connprops-interceptor-classes-and-interfaces.html, which covers relevant interceptor classes and interfaces potentially involved in the JDBC configuration.