Apache Kylin: improper restriction of file read
Priority MEDIUM 55CWE-552Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-552.
Summary
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.26124 98th percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin (Maven): 5.0.3org.apache.kylin:kylin-common-server (Maven): 5.0.3+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Kylin | 4.0.0 – 5.0.2 | — | No fix listed | CNA |
| — | org.apache.kylin:kylin (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-common-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-common-service (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-core-common (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-core-metadata (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-ops-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
| — | org.apache.kylin:kylin-server (Maven) | 4.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-p86w-w5rh-m3hx |
- Apache Kylin VendorApache Affected 4.0.0 – 5.0.2 Fixed in — No fix listed CNA
- org.apache.kylin:kylin (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-common-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-common-service (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-core-common (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-core-metadata (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-ops-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
- org.apache.kylin:kylin-server (Maven) Vendor— Affected 4.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p86w-w5rh-m3hx
Remediation
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-common-server (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-common-service (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-core-common (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-core-metadata (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-ops-server (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-p86w-w5rh-m3hx org.apache.kylin:kylin-server (Maven) Fixed in 5.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61734
- 2026-10-03 Alias added: GHSA-p86w-w5rh-m3hx
References
Advisory 2
More Apache Kylin vulnerabilities
- TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
- TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
- TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
- TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-61734 · CVE Program
- CVE-2025-61734 · NVD
- FIRST EPSS
- GHSA-p86w-w5rh-m3hx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences