PT-2025-38621 · Apache · Apache Linkis

Kinghao + 1 · Published 2025-09-19 · Updated 2026-01-24 · CVE-2025-29847

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.0 through 1.7.0

Description A flaw exists in Apache Linkis when utilizing the JDBC engine and data source functionality. Multiple rounds of URL encoding applied to the URL parameter configured on the frontend can circumvent system checks. This bypass may enable unauthorized access to system files through JDBC parameters. The issue is related to insufficient validation of connection information, specifically regarding the presence of the '%' character.

Recommendations Upgrade to version 1.8.0, which addresses this issue. Continuously check if the connection information contains the "%" character and perform URL decoding if it does.

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

CWE-177

Related Identifiers

CVE-2025-29847

GHSA-C399-Q49H-QWC8

Affected Products

Apache Linkis

References · 11

• https://osv.dev/vulnerability/CVE-2025-29847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29847 · Security Note
• https://lists.apache.org/thread/03l5rfkgdt022o75jp8x4tzpqxz8g057 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c399-q49h-qwc8 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://twitter.com/oss_security/status/1969089149161418955 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/19/2 · Note
• https://twitter.com/VulmonFeeds/status/2013191136366493783 · Twitter Post
• https://twitter.com/CVEnew/status/2013173939854520643 · Twitter Post
• https://twitter.com/cracbot/status/2015016789311389702 · Twitter Post
• https://lists.apache.org/list?[e-mail]:2025-9:cve · Note