GHSA-p86w-w5rh-m3hx

Suggest an improvement
Source
https://github.com/advisories/GHSA-p86w-w5rh-m3hx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p86w-w5rh-m3hx
Aliases
Published
2025-10-02T12:31:06Z
Modified
2025-11-05T20:52:47Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Kylin Files or Directories Accessible to External Parties
Details

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-552"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-02T21:03:33Z",
    "nvd_published_at":  "2025-10-02T10:15:40Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven
org.apache.kylin:kylin

Package

Name
org.apache.kylin:kylin
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-common-server

Package

Name
org.apache.kylin:kylin-common-server
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-common-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-common-service

Package

Name
org.apache.kylin:kylin-common-service
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-common-service

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-core-common

Package

Name
org.apache.kylin:kylin-core-common
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-core-common

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-core-metadata

Package

Name
org.apache.kylin:kylin-core-metadata
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-core-metadata

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-ops-server

Package

Name
org.apache.kylin:kylin-ops-server
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-ops-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

5.*
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"
org.apache.kylin:kylin-server

Package

Name
org.apache.kylin:kylin-server
View open source insights on deps.dev
Purl
pkg:maven/org.apache.kylin/kylin-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.0.3

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
5.*
5.0.0-alpha
5.0.0-beta
5.0.0
5.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-p86w-w5rh-m3hx/GHSA-p86w-w5rh-m3hx.json"