Arbitrary File Read

🗓️ 12 Jun 2025 08:15:23Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 8 Views

Vulnerability in Kafka clients allows arbitrary file read due to insufficient URL validation.

Reporter	Title	Published	Views	Family All 80
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Apache kafka-client may affect IBM Business Automation Workflow - CVE-2025-27817, CVE-2025-27818	6 Nov 202510:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Kafka affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	25 Aug 202515:57	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Kafka Client affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	12 Dec 202520:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	13 Oct 202520:59	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary File Read and SSRF via Unrestricted URL Configuration in Apache Kafka Client SASL/OAUTHBEARER Settings, affects watsonx.data	11 Sep 202508:52	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for December 2025.	23 Dec 202508:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Sept 2025 - Multiple CVEs addressed	28 Oct 202506:30	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-27817)	4 Aug 202506:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to Apache Kafka ( CVE-2025-27817,CVE-2025-27818 & CVE-2025-27819 )	22 Aug 202512:52	–	ibm

Vulners

Node

apache kafka-clientsRange3.1.0–3.9.0java

apache kafka-clientsMatch3.1.0java

apache kafka-clientsMatch3.1.1java

apache kafka-clientsMatch3.1.2java

apache kafka-clientsMatch3.2.0java

apache kafka-clientsMatch3.2.1java

apache kafka-clientsMatch3.2.2java

apache kafka-clientsMatch3.2.3java

apache kafka-clientsMatch3.3.0java

apache kafka-clientsMatch3.3.1java

apache kafka-clientsMatch3.3.2java

apache kafka-clientsMatch3.4.0java

apache kafka-clientsMatch3.4.1java

apache kafka-clientsMatch3.5.0java

apache kafka-clientsMatch3.5.1java

apache kafka-clientsMatch3.5.2java

apache kafka-clientsMatch3.6.0java

apache kafka-clientsMatch3.6.1java

apache kafka-clientsMatch3.6.2java

apache kafka-clientsMatch3.7.0java

apache kafka-clientsMatch3.7.1java

apache kafka-clientsMatch3.7.2java

apache kafka-clientsMatch3.8.0java

apache kafka-clientsMatch3.8.1java

Source	Link
kafka	www.kafka.apache.org/cve-list
openwall	www.openwall.com/lists/oss-security/2025/06/09/1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-27817
github	www.github.com/apache/kafka

03 Jun 2026 09:43Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.21423

SSVC