Skip to content
Fencer Vulns
high 7.5

CVE-2020-17518 in the critical feed json

Apache Flink directory traversal attack: remote file writing through the REST API

published 2021-01-05 5 y ago modified 2026-09-08 2 mo ago also BIT-flink-2020-17518 , EUVD-2022-0892 , GHSA-7q5g-gph2-4rc6

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
49.4%
EPSS 49.4% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

Patch / fix

  • maven org.apache.flink:flink-runtime 1.11.3
  • bitnami flink 1.11.3
  • apache flink 1.11.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-17518 updated cvss 7.5

apache-flink: directory traversal attack allows remote file writing through the REST API

  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat Integration
    fixed: vendor fix RHSA-2021:3205
  • Red Hat Integration Camel Quarkus 2
    fixed: vendor fix RHSA-2021:3207
  • Red Hat Integration Camel K 1 flink Red Hat Integration Camel Quarkus 1 flink
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

49.38% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Apache Flink 1.5.1 - Local File Inclusion nuclei detection template

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.flink:flink-runtime
>=1.5.1, <1.11.3
1.11.3
bitnami flink
>=1.5.1, <1.11.3
1.11.3

Affected products

  • Apache Software Foundation Apache Flink

Classification

Weakness
  • CWE-23 Relative Path Traversal
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.