Advisoriesby IbiskylinGHSA-p86w-w5rh-m3hx
Apache Kylin Files or Directories Accessible to External Parties
Fix: upgrade to 5.0.3 or later
Files or Directories Accessible to External Parties vulnerability in Apache Kylin.
You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | >= 4.0.0, < 5.0.3 | 5.0.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-552
- Also known as
- CVE-2025-61734
- nvd.nist.gov/vuln/detail/CVE-2025-61734
- github.com/apache/kylin/pull/2332
- github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
- github.com/apache/kylin
- issues.apache.org/jira/browse/KYLIN-6082
- lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2
- www.openwall.com/lists/oss-security/2025/09/30/8
More kylin advisories
All kylin
Apache Kylin Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61735fixed in 5.0.3Apache Kylin Authentication Bypass VulnerabilityCVE-2025-61733fixed in 5.0.3Apache Kylin Code Injection via JDBC Configuration AlterationCVE-2025-30067fixed in 5.0.2Apache Kylin Session Fixation vulnerabilityCVE-2024-23590fixed in 5.0.0Apache Kylin vulnerable to Command injection by Useless configurationCVE-2022-43396fixed in 4.0.3Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1