CVE-2023-46801

Apache Linkis vulnerable to remote code execution in the DataSource MySQL handler for versions = 1.8.0_241 and/or upgrade Linkis to version 1.6.0. If upgrading is not immediately possible, validate and restrict JRMP usage and account privileges to reduce exposure. If exploitation details are not ...

CVE-2022-39944

Summary: CVE-2022-39944 affects Apache Linkis <= 1.2.0 when used with MySQL Connector/J, enabling a deserialization vulnerability that can lead to remote code execution if an attacker has write access to a database and provides malicious parameters in a JDBC EC with a MySQL data source. The is...

CVE-2023-29216

In Apache Linkis, the DatasourceManager module (<=1.3.1) suffers a deserialization vulnerability caused by unfiltered parameters, enabling an attacker to configure a new data source via the MySQL data source and trigger remote code execution. Affected versions: Linkis 1.3.1 and earlier (

CVE-2023-49566

CVE-2023-49566 affects Apache Linkis 1.5.0 and earlier, specifically the DataSource Manager Module where DB2 URL parameters can be crafted to trigger a JNDI injection due to insufficient filtering. The attack requires an attacker with an authorized Linkis account and can enable exploitation throu...

CVE-2023-50740

Apache Linkis versions

CVE-2024-45627

Apache Linkis versions prior to 1.7.0 are vulnerable to an arbitrary file read vulnerability due to insufficient parameter filtering in the DataSource Manager Module . An attacker with an authorized account can configure malicious Mysql JDBC parameters to read arbitrary files from the Linkis serv...

CVE-2022-44645

CVE-2022-44645 affects Apache Linkis

CVE-2022-44644

CVE-2022-44644 — Apache Linkis local file read vulnerability . Affected: Apache Linkis

CVE-2023-41916

CVE-2023-41916 affects Apache Linkis DataSource Manager: inadequate filtering of parameters allows an authorized attacker to configure malicious MySQL JDBC parameters and trigger arbitrary file reads in Linkis

CVE-2024-39928

Apache Linkis versions 1.3.0 through 1.5.0 are vulnerable to a weak random string generation issue in the Spark EngineConn component. The vulnerability arises because the Token generates random strings using Commons Lang's RandomStringUtils when starting Py4j . This insecure generation allows an ...

CVE-2023-27602

Summary: CVE-2023-27602 affects Apache Linkis <= 1.3.1, where the PublicService module allows uploading files without restrictions on path or type. This may enable arbitrary file uploads and, per CNVD, could lead to remote code execution. Impact (as stated): Potential total impact via arbitrar...

CVE-2023-27603

CVE-2023-27603 affects Apache Linkis

CVE-2023-27987

CVE-2023-27987 affects Apache Linkis

CVE-2023-29215

Affected software : Apache Linkis 1.3.1 and earlier (<= 1.3.1;

CVE-2024-27181

Apache Linkis versions

CVE-2024-27182

CVE-2024-27182 affects Apache Linkis

CVE-2025-29847

Apache Linkis versions 1.3.0 through 1.7.0 are vulnerable to an arbitrary file read vulnerability when using the JDBC engine and data source functionality. The root cause is insufficient validation of connection information, where URL parameters configured on the frontend that have undergone mult...

CVE-2025-59355

Apache Linkis versions 1.0.0 through 1.7.0 are vulnerable to information leakage due to improper error logging in the org.apache.linkis.metadata.util.HiveUtils.decode() function. When the system fails to perform Base64 decoding on an invalid input string, it records the full, undecoded parameter—...