PT-2025-40311 · Apache · Apache Kylin

Liuhuajin · Published 2025-10-01 · Updated 2025-10-02 · CVE-2025-61734

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.0 through 5.0.2

Description A flaw exists in Apache Kylin that could allow external parties to access files or directories. Proper protection of Kylin's system and project admin access is crucial to prevent exploitation.

Recommendations Upgrade to version 5.0.3 to resolve the issue.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-61734

GHSA-P86W-W5RH-M3HX

Affected Products

Apache Kylin

References · 12

• https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p86w-w5rh-m3hx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61734 · Security Note
• https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662 · Note
• https://github.com/apache/kylin · Note
• https://github.com/apache/kylin/pull/2332 · Note
• https://twitter.com/CVEnew/status/1973693361954386400 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/30/8 · Note
• https://t.me/CVEtracker/33921 · Telegram Post
• https://twitter.com/oss_security/status/1973527258469122101 · Twitter Post
• https://issues.apache.org/jira/browse/KYLIN-6082 · Note