Apache Linkis (Apache Software Foundation) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-01-19. Vendor: Apache Software Foundation.

CVEs of Apache Linkis

• CVE-2025-59355 - CVSS 6.5 (medium), 2026-01-19: A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in…
• CVE-2025-29847 - CVSS 7.5 (high), 2026-01-19: A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL…
• CVE-2023-27603 - CVSS 9.8 (critical), 2023-04-10: In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to…
• CVE-2023-29216 - CVSS 9.8 (critical), 2023-04-10: In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a…
• CVE-2023-29215 - CVSS 9.8 (critical), 2023-04-10: In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn…
• CVE-2023-27987 - CVSS 9.1 (critical), 2023-04-10: In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default…
• CVE-2023-27602 - CVSS 9.8 (critical), 2023-04-10: In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users…
• CVE-2022-39944 - CVSS 8.8 (high), 2022-10-26: In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an…