CVE-2025-61734 — Files or Directories Accessible to External Parties in Apache Kylin

CWE-552 — Files or Directories Accessible to External Parties4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 77.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache KylinApache Software Foundation Apache Kylin
Timeline
PublishedOct 2

Description

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/kylin4.0.0 — 5.0.3
▶CVEListV5apache_software_foundation/apache_kylin4.0.0 — 5.0.2

🔴Vulnerability Details

3
OSV
Apache Kylin Files or Directories Accessible to External Parties↗2025-10-02
▶
CVEList
Apache Kylin: improper restriction of file read↗2025-10-02
▶
GHSA
Apache Kylin Files or Directories Accessible to External Parties↗2025-10-02
▶
CVE-2025-61734 — Apache Kylin vulnerability | cvebase