diff --git a/pom.xml b/pom.xml
index 9fee42151..3b7c4b3fc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,7 +40,7 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <maven-surefire-plugin.version>3.2.2</maven-surefire-plugin.version>
         <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
-        <flatten-maven-plugin.version>1.6.0</flatten-maven-plugin.version>
+        <flatten-maven-plugin.version>1.7.2</flatten-maven-plugin.version>
         <!-- maven-surefire-plugin 暂时无法通过 bom 的依赖读取（兼容老版本 IDEA 2024 及以前版本） -->
         <lombok.version>1.18.38</lombok.version>
         <spring.boot.version>3.5.4</spring.boot.version>
diff --git a/yudao-dependencies/pom.xml b/yudao-dependencies/pom.xml
index d7ae29d0d..429cfa182 100644
--- a/yudao-dependencies/pom.xml
+++ b/yudao-dependencies/pom.xml
@@ -15,7 +15,7 @@
 
     <properties>
         <revision>2025.08-SNAPSHOT</revision>
-        <flatten-maven-plugin.version>1.6.0</flatten-maven-plugin.version>
+        <flatten-maven-plugin.version>1.7.2</flatten-maven-plugin.version>
         <!-- 统一依赖管理 -->
         <spring.boot.version>3.5.4</spring.boot.version>
         <spring.cloud.version>2025.0.0</spring.cloud.version>
@@ -66,6 +66,7 @@
         <guava.version>33.4.8-jre</guava.version>
         <transmittable-thread-local.version>2.14.5</transmittable-thread-local.version>
         <commons-net.version>3.11.1</commons-net.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
         <jsch.version>0.1.55</jsch.version>
         <tika-core.version>3.1.0</tika-core.version>
         <ip2region.version>2.7.0</ip2region.version>
@@ -580,6 +581,12 @@
                 <version>${jsch.version}</version>
             </dependency>
 
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>${commons-lang3.version}</version> <!-- 解决 CVE-2025-48924 漏洞 -->
+            </dependency>
+
             <dependency>
                 <groupId>com.anji-plus</groupId>
                 <artifactId>captcha-spring-boot-starter</artifactId> <!-- 验证码，一般用于登录使用 -->