CVE-2021-28655

Apache Zeppelin: Arbitrary file deletion vulnerability

6.5 MediumFix available

CVE-2021-28655 is a medium vulnerability (CVSS 6.5) in Apache Zeppelin, published December 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in org.apache.zeppelin:zeppelin 0.10.0.

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

1.64%Up 0.8 points since Dec 17, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2021-28655
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-20
Updated: 2026-11-02

CVE List 6.5

Apache Zeppelin: Arbitrary file deletion vulnerability

Record: CVE-2021-28655
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2023-2065 6.5

Record: EUVD-2023-2065
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gm67-h5wr-w3cv 6.5

Apache Zeppelin Improper Input Validation vulnerability

The improper Input Validation vulnerability in Move folder to Trash feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

Record: GHSA-gm67-h5wr-w3cv
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-20
Updated: 2026-11-02

OSV 6.5

Record: CVE-2021-28655
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVGHSA-gm67-h5wr-w3cv 6.5