CVE-2025-29847 json
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass
published 2026-01-19 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-3229 , GHSA-c399-q49h-qwc8
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
A vulnerability in Apache Linkis.
Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger a vulnerability that allows unauthorized access to system files via JDBC parameters.
Scope of Impact
This issue affects Apache Linkis: from 1.3.0 through 1.7.0.
Severity level
moderate Solution Continuously check if the connection information contains the "%" character; if it does, perform URL decoding.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
More questions about this vulnerability can be discussed here: https://lists.apache.org/list?dev@linkis.apache.org:2025-9:cve
Patch / fix
- maven org.apache.linkis:linkis 1.8.0
- apache linkis 1.8.0
- org.apache.linkis linkis 1.8.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.linkis:linkis | >=1.3.0, <1.8.0 |
1.8.0 |
Affected products
- Apache Software Foundation Apache Linkis
Classification
References
-
lists.apache.org
/thread/03l5rfkgdt022o75jp8x4tzpqxz8g057
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/09/19/2
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-29847
advisory
-
github.com
/apache/linkis
package
-
lists.apache.org
/list?dev@linkis.apache.org:2025-9:cve
web
Sources
- CVE List CVE-2025-29847
- GitHub Advisory GHSA-c399-q49h-qwc8
- NVD CVE-2025-29847
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.