CVE-2025-61734

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2	Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/09/30/8

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de archivos o directorios accesibles a terceros externos en Apache Kylin. Está a salvo siempre y cuando el acceso de administrador del sistema y del proyecto de Kylin esté bien protegido. Este problema afecta a Apache Kylin: desde la versión 4.0.0 hasta la 5.0.2. Se recomienda a los usuarios que actualicen a la versión 5.0.3, la cual corrige el problema.

Information

Published : 2025-10-02 10:15

Updated : 2026-10-12 15:10

NVD link : CVE-2025-61734

Mitre link : CVE-2025-61734

CVE.ORG link : CVE-2025-61734

JSON object : View

Products Affected

apache

kylin

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2025-61734", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61734", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-02T17:26:13.841848Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Kylin", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-02T10:15:40.100", "references": [{"url": "https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/30/8", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "Files or Directories Accessible to External Parties vulnerability in Apache Kylin.\n You are fine as long as the Kylin's system and project admin access is well protected.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de archivos o directorios accesibles a terceros externos en Apache Kylin.\nEst\u00e1 a salvo siempre y cuando el acceso de administrador del sistema y del proyecto de Kylin est\u00e9 bien protegido.\n\nEste problema afecta a Apache Kylin: desde la versi\u00f3n 4.0.0 hasta la 5.0.2.\n\nSe recomienda a los usuarios que actualicen a la versi\u00f3n 5.0.3, la cual corrige el problema."}], "lastModified": "2026-10-12T15:10:00.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0732C89B-68F0-406A-977F-C75F554B17DD", "versionEndExcluding": "5.0.3", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}