Apache Apache Linkis
8 CVEs affecting Apache Apache Linkis. Latest disclosed: 2026-01-19. Critical: 5, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29216 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a… |
CVE-2023-29215 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Mod… |
CVE-2023-27603 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a p… |
CVE-2023-27602 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users u… |
CVE-2023-27987 | Critical | 9.1 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default tok… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2025-29847 | High | 7.5 | 2026-01-19 | A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL p… |
CVE-2025-59355 | Medium | 6.5 | 2026-01-19 | A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in t… |