CVE-2020-17519

The Apache Flink streaming and batch data processing platform is vulnerable to a directory traversal and improper access control issue in its REST interface component. This vulnerability allows an attacker to read arbitrary files on the JobManager local filesystem, restricted to files accessible ...

CVE-2020-17518

CVE-2020-17518 affects Apache Flink 1.5.1. A REST file upload handler allowed an attacker to write a file to an arbitrary location on the local filesystem by manipulating the HTTP header (directory-traversal via file upload). The issue is mitigated by upgrading Flink to 1.11.3 or 1.12.0 (where th...

CVE-2026-35194

Apache Flink versions 1.15.0 through 1.20.3 and 2.0.0 through 2.2.0 are vulnerable to code injection during SQL code generation. The root cause is the improper escaping of user-controlled strings when interpolated into generated Java code, specifically affecting JSON functions (1.15.0+) and LIKE ...

CVE-2020-1960

CVE-2020-1960 (Apache Flink) affects multiple Flink versions (1.1.0–1.10.0). When a process runs with an enabled JMXReporter and a port configured via metrics.reporter.reporter_name>.port, a local attacker with access to the JMX port can perform a man-in-the-middle attack to rebind the JMXRMI ...