Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation

🗓️ 30 Jun 2026 15:30:46Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 2 Views

SQL misconfiguration in Gravitino UI allows file reads or truncation.

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2025-53648	30 Jun 202613:36	–	attackerkb
Circl	CVE-2025-53648	30 Jun 202616:10	–	circl
CVE	CVE-2025-53648	30 Jun 202613:36	–	cve
Cvelist	CVE-2025-53648 Apache Gravitino: SQL misconfiguration can access or truncate files	30 Jun 202613:36	–	cvelist
EUVD	EUVD-2025-210372	30 Jun 202613:36	–	euvd
Mend	CVE-2025-53648	30 Jun 202613:36	–	mend
NVD	CVE-2025-53648	30 Jun 202614:16	–	nvd
osv_cve	CVE-2025-53648 Apache Gravitino: SQL misconfiguration can access or truncate files	30 Jun 202613:36	–	osv_cve
Positive Technologies	PT-2026-53882	30 Jun 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-53648: Improper Neutralization of Special Elements used in an SQL Command	30 Jun 202600:00	–	rapid7

Vulners

Node

org.apache.gravitino catalog-jdbc-commonRange0.5.0–1.0.0maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-53648
lists	www.lists.apache.org/thread/s0hytcv17z52dwp5dojjjwgrtqtyh2xk
openwall	www.openwall.com/lists/oss-security/2026/06/30/2
github	www.github.com/apache/gravitino/pull/8000
github	www.github.com/github/advisory-database/pull/10102
github	www.github.com/apache/gravitino/commit/5355bd075d54cad1323606723e72cc32ca564f24
github	www.github.com/apache/gravitino/releases/tag/v1.0.0
github	www.github.com/advisories/GHSA-7ph3-grqh-pv9v

05 Nov 2026 18:05Current

CVSS 3.15.4

EPSS0.00561

SSVC

Gravitino UI file read file truncation SQL misconfiguration