CVE-2025-47771: PowSyBl Core allows deserialization of untrusted SparseMatrix data

What kind of vulnerability is it? Who is impacted?

This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method of the SparseMatrix class. This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be exposed to untrusted input in at least two use cases:

• A user can adopt this method in an application where users can submit an InputStream and the application parses it into a SparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels.
• A user adopts the method for a local tool but receives the InputStream from external sources.