Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-30065 — This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls. | Kitploit
Tools/GitHubGitHub/h3st4k3r/cve-2025-30065
Vulnerability AnalysisCode AnalysisExploitationLearning & EducationBinary ExploitationLabs & Practice
GitHubh3st4k3r/cve-2025-30065

CVE-2025-30065

View Repository
721 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

About

This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls.

Share

CVE-2025-30065 Research Notes

Status License Language Security

This repository is kept intentionally small and readable. It is intended for authorized security research, local validation, and defensive study of CVE-2025-30065 in Apache Parquet / Avro schema handling.

The README focuses on repository hygiene, build reproducibility, and safe use. It does not provide operational exploitation guidance.

What is in the repository

  • A Java-based research harness.
  • A small set of source files used to study the vulnerability in a controlled lab.
  • A Maven build definition.
  • A helper script to compile and run the project locally.

Prerequisites

  • Java 8 or newer.
  • Maven.
  • A controlled test environment that you own or are explicitly authorized to use.

Build and run

root@kitploit:~
chmod +x run.sh
./run.sh

If you prefer to run the build manually:

root@kitploit:~
mvn clean package

Safety notes

  • Only use this repository in systems where you have explicit permission.
  • Keep the environment isolated from production systems and third-party networks.
  • If you are validating a fix, verify the patched dependency versions and your classpath controls first.

Documentation style

The repository is documented in plain English with short sections, clear headings, and minimal clutter.

Maintainers

  • h3st4k3r

See CONTRIBUTORS.md for the contributor list.

License

See LICENSE.

Security

See SECURITY.md for responsible disclosure and contact guidance.

Acknowledgements

Thanks to:

  • @micrictor for highlighting the difference between conceptual schema injection and the actual patch logic.
  • Mouad Kondah for the public PoC that followed the correct constructor path.
  • F5 Labs for documenting the real-world implications and providing strong public visibility.
  • Everyone contributing through discussion and responsible disclosure.

Notes for reviewers

The code is intended for defensive research, not for broad distribution or operational reuse. If you are comparing behavior before and after a patch, keep the validation confined to a lab and document your test conditions.

Download Tool