PT-2025-38130 · Apache · Apache Streampark

Liufeng Yi · Published 2025-09-17 · Updated 2025-10-15 · CVE-2025-30001

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions 2.1.4 through 2.1.5

Description An issue exists in Apache StreamPark that allows authenticated users to trigger remote command execution.

Recommendations Upgrade to version 2.1.6 to resolve the issue.

Fix

Weakness Enumeration

CWE-279

Related Identifiers

CVE-2025-30001

GHSA-6WWV-6MM3-PP76

Affected Products

Apache Streampark

References · 12

• https://lists.apache.org/thread/xfmsvhkcnr1831n0w5ovy3p44lsmfb7m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30001 · Security Note
• https://osv.dev/vulnerability/GHSA-6wwv-6mm3-pp76 · Vendor Advisory
• https://github.com/apache/streampark · Note
• https://twitter.com/VulmonFeeds/status/1976758270560780750 · Twitter Post
• https://twitter.com/CVEnew/status/1976592785622090135 · Twitter Post
• https://twitter.com/cracbot/status/1978415605930991669 · Twitter Post
• https://t.me/cveNotify/138122 · Telegram Post
• https://twitter.com/oss_security/status/1968109879924756663 · Twitter Post
• https://t.me/CVEtracker/34561 · Telegram Post
• http://openwall.com/lists/oss-security/2025/09/04/1 · Note