Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these files, enabling attackers achieve Remote Code Execution (RCE) by submitting carefully crafted payloads thereby gain access target server. This issue is fixed in version 3.0-20251107.114628.