{"id":"CVE-2025-53648","aliases":["EUVD-2025-210372","GHSA-7ph3-grqh-pv9v"],"status":"published","title":"Apache Gravitino: SQL misconfiguration can access or truncate files","description":"SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00561,"percentile":0.46982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-06-30T13:36:00Z","modified":"2026-11-05T18:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.gravitino:catalog-jdbc-common","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.gravitino:catalog-jdbc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.gravitino:catalog-jdbc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"1.0.0"}]}],"versions":["0.6.0-incubating","0.6.1-incubating","0.7.0-incubating"]}],"products":[{"vendor":"apache","product":"gravitino"},{"vendor":"apache software foundation","product":"apache gravitino"}],"references":[{"url":"https://lists.apache.org/thread/s0hytcv17z52dwp5dojjjwgrtqtyh2xk","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/30/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53648","tags":["advisory"]},{"url":"https://github.com/apache/gravitino/pull/8000","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/10102","tags":["web"]},{"url":"https://github.com/apache/gravitino/commit/5355bd075d54cad1323606723e72cc32ca564f24","tags":["web"]},{"url":"https://github.com/apache/gravitino/releases/tag/v1.0.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7ph3-grqh-pv9v"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53648.json","tags":["advisory"]},{"url":"https://github.com/apache/gravitino","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-53648","title":"Apache Gravitino: SQL misconfiguration can access or truncate files","description":"SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T13:36:00.654Z","modified":"2026-06-30T17:35:41.726Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-210372","description":"SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T13:36:00Z","modified":"2026-06-30T17:35:41Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:21.147551Z"}],"ghsa":[{"id":"GHSA-7ph3-grqh-pv9v","title":"Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation","description":"SQL misconfiguration in the Gravitino UI, in versions 0.5.0 until 1.0.0, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T15:30:46Z","modified":"2026-11-05T18:05:13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T18:25:16.830347Z"}],"nvd":[{"id":"CVE-2025-53648","description":"SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T14:16:24.193Z","modified":"2026-09-29T19:10:00.16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-53648","title":"Apache Gravitino: SQL misconfiguration can access or truncate files","description":"SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T13:36:00.654Z","modified":"2026-11-05T18:26:15.862852173Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T18:56:24.528438Z"},{"id":"GHSA-7ph3-grqh-pv9v","title":"Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation","description":"SQL misconfiguration in the Gravitino UI, in versions 0.5.0 until 1.0.0, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","status":"published","published":"2026-06-30T15:30:46Z","modified":"2026-11-05T18:15:03.892894785Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-05T18:26:18.409022Z"}]}}