CVE-2025-61734
Apache Kylin: improper restriction of file read
CVE-2025-61734 is a high vulnerability (CVSS 7.5) in Apache Kylin, published October 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 28.8%, the 98th percentile. Fixed in org.apache.kylin:kylin 5.0.3.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 28.8%EPSS, 98th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.0.3org.apache.kylin:kylin +13 more
Description
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.kylin:kylinMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-common-serverMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-common-serviceMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-core-commonMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-core-metadataMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-ops-serverMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylin-serverMaven | 4.0.0 up to 5.0.3 | 5.0.3 |
org.apache.kylin:kylinMaven | 4.0.0 up to 5.0.3, plus listed versions 4.0.14.0.24.0.34.0.45.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
org.apache.kylin:kylin-common-serverMaven | 4.0.0 up to 5.0.3, plus listed versions 5.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
org.apache.kylin:kylin-common-serviceMaven | 4.0.0 up to 5.0.3, plus listed versions 5.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.kylin:kylin-core-commonMaven | 4.0.0 up to 5.0.3, plus listed versions 4.0.14.0.24.0.34.0.45.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
org.apache.kylin:kylin-core-metadataMaven | 4.0.0 up to 5.0.3, plus listed versions 4.0.14.0.24.0.34.0.45.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
org.apache.kylin:kylin-ops-serverMaven | 4.0.0 up to 5.0.3, plus listed versions 5.0.05.0.2 | 5.0.3 |
org.apache.kylin:kylin-serverMaven | 4.0.0 up to 5.0.3, plus listed versions 4.0.14.0.24.0.34.0.45.0.05.0.0-alpha5.0.0-beta5.0.2 | 5.0.3 |
What each source reports
CVE List Score used
Apache Kylin: improper restriction of file read
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
CVE-2025-61734- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
EUVDEUVD-2025-32643
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
EUVD-2025-32643- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p86w-w5rh-m3hx
Apache Kylin Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
GHSA-p86w-w5rh-m3hx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
NVD
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
CVE-2025-61734- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
OSV
Apache Kylin: improper restriction of file read
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
CVE-2025-61734- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
OSVGHSA-p86w-w5rh-m3hx
Apache Kylin Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- Record
GHSA-p86w-w5rh-m3hx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-552
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2
openwall.com/lists/oss-security/2025/09/30/8
nvd.nist.gov/vuln/detail/CVE-2025-61734
github.com/apache/kylin/pull/2332
issues.apache.org/jira/browse/KYLIN-6082