What is CVE-2025-29847?

CVE-2025-29847 is a high-severity vulnerability in Apache Linkis, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-01-19.

How severe is CVE-2025-29847?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-29847 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Apache Linkis

CVE-2025-29847

A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encodin…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Linkis
Apache Software Foundation Linkis — versions 1.3.0

Weakness classification (CWE)

Public proof-of-concept exploits

for-A1kaid/for-A1kaid

References

security@apache.org (vendor-advisory, Mailing List)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-29847?: CVE-2025-29847 is a high-severity vulnerability in Apache Linkis, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-01-19.
How severe is CVE-2025-29847?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-29847 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.