GitHub Advisoryadvisory · Maven

GHSA-p86w-w5rh-m3hx Apache Kylin Files or Directories Accessible to External Parties

HIGH Published 2025-10-02 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-61734
Ecosystem
Maven
Packages
org.apache.kylin:kylin, org.apache.kylin:kylin-common-server, org.apache.kylin:kylin-common-service, org.apache.kylin:kylin-core-common, org.apache.kylin:kylin-core-metadata, org.apache.kylin:kylin-ops-server, org.apache.kylin:kylin-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-552
Reviewed
2025-10-02

Affected packages

• Maven org.apache.kylin:kylin: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-common-server: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-common-service: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-core-common: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-core-metadata: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-ops-server: >= 4.0.0, < 5.0.3 → fixed in 5.0.3 • Maven org.apache.kylin:kylin-server: >= 4.0.0, < 5.0.3 → fixed in 5.0.3

Description

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-61734 Files or Directories Accessible to External Parties vulnerability in Apache Kylin. vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References