CVE-2025-29847

CWE-20 — Improper Input ValidationCWE-22 — Path TraversalCWE-1775 documents5 sources
Severity
7.5HIGH
EPSS
0.1%
top 68.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache LinkisApache Software Foundation Apache Linkis
Timeline
PublishedJan 19

Description

A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger a vulnerability that allows unauthorized access to system files via JDBC parameters. Scope of Impact This issue affects Apache Linkis: from 1.3.0 through 1.7.0. Severity level moderate Solution…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/linkis1.3.0 — 1.8.0
▶Mavenorg.apache.linkis:linkis1.3.0 — 1.8.0
▶CVEListV5apache_software_foundation/apache_linkis1.3.0 — 1.7.0

🔴Vulnerability Details

3
GHSA
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass↗2026-01-19
▶
OSV
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass↗2026-01-19
▶
CVEList
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass↗2026-01-19
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-29847 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-29847 (HIGH CVSS 7.5) | A vulnerability in Apache Linkis | cvebase.io