CVE-2025-29847: Apache Linkis Arbitrary File Read via Double URL Encoding Bypass
Summary
CVE-2025-29847: Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass. Affects org.apache.linkis:linkis versions >= 1.3.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is an open-source data integration platform that facilitates the management and orchestration of data processing tasks. It provides a JDBC engine and data source functionality that allows users to connect to various databases seamlessly. However, certain configurations can expose the system to vulnerabilities, particularly when URL parameters are improperly handled.
Vulnerability Detail
A vulnerability exists in Apache Linkis versions 1.3.0 through 1.7.0, where multiple rounds of URL encoding on the JDBC parameters can bypass system checks. This flaw can lead to unauthorized access to sensitive system files, posing a significant security risk. Attackers can exploit this vulnerability to read arbitrary files from the server, potentially leading to data breaches or further exploitation of the system.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, continuously check if the connection information contains the '%' character. If it does, perform URL decoding to mitigate the risk of unauthorized file access.
Conclusion
The vulnerability identified as CVE-2025-29847 in Apache Linkis poses a significant risk due to improper handling of URL parameters, allowing unauthorized file access. Users are strongly encouraged to upgrade to version 1.8.0 to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for org.apache.linkis:linkis →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Apache Linkis versions from 1.3.0 to 1.7.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, implement the suggested workaround by checking for '%' characters in connection information and performing URL decoding.
More information can be found on the Apache mailing lists or by reviewing the advisory details on GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.linkis:linkis.
