GHSA-6874-289g-f7h7
Apache StreamPark Path Traversal vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.streampark:streampark-common_2.12 | < 2.0.0 | 2.0.0 |
| Maven | org.apache.streampark:streampark-common_2.11 | < 2.0.0 | 2.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type. This means users may upload some high-risk files, and may upload them to any directory. Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
References
External links from the advisory. They lead to third-party sites.