{"id":"CVE-2025-53648","kind":"vulnerability","aliases":["CVE-2025-53648","GHSA-7ph3-grqh-pv9v"],"related":[],"title":"Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation","description":"SQL misconfiguration in the Gravitino UI, in versions 0.5.0 until 1.0.0, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","summary":"Apache Gravitino's JDBC catalog configuration validation can be bypassed through the UI, letting a malicious user read or truncate files on the server. The advisory ties the flaw to SQL injection (CWE-89) in versions 0.5.0 through 1.0.0.","severity":"medium","cvss":5.4,"epss":0.00561,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.gravitino:catalog-jdbc-common","fixed":["1.0.0"],"affected":">= 0.5.0, < 1.0.0","ecosystem":"maven"},{"name":"apache gravitino","fixed":["1.0.0"],"affected":">= 0.5.0, < 1.0.0","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["apache-gravitino","cwe-89","java","jdbc","package","self-hosted"],"not_affected_if":["no-ui-exposure","version-1.0.0-or-later"],"how_to_check":"- Check the version of `org.apache.gravitino:catalog-jdbc-common` in your build files, looking for anything from `0.5.0` up to but not including `1.0.0`\n- Check whether the Gravitino web UI is reachable and whether JDBC catalogs can be created or edited through it","fix":"- Upgrade `org.apache.gravitino:catalog-jdbc-common` to `1.0.0`","status":"open","published_at":"2026-06-30T14:16:24+00:00","first_seen_at":"2026-11-05T18:09:54+00:00","triaged_at":"2026-11-05T18:11:08+00:00","updated_at":"2026-11-05T18:40:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T18:11:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.apache.gravitino:catalog-jdbc-common` to `1.0.0`","reach":"network","title":"Apache Gravitino: JDBC config check bypass lets users read or truncate files","impact":"medium","summary":"Apache Gravitino's JDBC catalog configuration validation can be bypassed through the UI, letting a malicious user read or truncate files on the server. The advisory ties the flaw to SQL injection (CWE-89) in versions 0.5.0 through 1.0.0.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-gravitino","jdbc","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Files on the server can be read or truncated by a malicious user","analyst_note":"","how_to_check":"- Check the version of `org.apache.gravitino:catalog-jdbc-common` in your build files, looking for anything from `0.5.0` up to but not including `1.0.0`\n- Check whether the Gravitino web UI is reachable and whether JDBC catalogs can be created or edited through it","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.0.0-or-later","no-ui-exposure"],"who_is_affected":"Teams running Apache Gravitino between 0.5.0 and 1.0.0 that expose its UI to users who can create or edit JDBC catalogs. The sources describe the risk as coming from a malicious user of the UI, so deployments with only trusted administrators or no UI exposure are lower risk. Teams on 1.0.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4317,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,22A '-53648':15A,23A '-89':35B,75B '0.5.0':78B,89C '1.0.0':80B,91C,109C '7ph3':18A 'advisori':67B 'allow':8A,93C 'apach':1A,32B,42B 'apache':29A 'apache-gravitino':31B 'bypass':6A,51B 'catalog':26A,46B 'catalog-jdbc-common':25A 'common':28A 'configur':4A,47B 'cve':13A,21A 'cwe':34B,74B 'file':9A,62B,101C 'fix':111C 'flaw':70B 'ghsa':17A 'ghsa-7ph3-grqh-pv9v':16A 'gravitino':2A,30A,33B,43B,85C 'grqh':19A 'host':41B 'inject':73B 'issu':113C 'java':36B 'jdbc':3A,27A,37B,45B 'let':55B 'malici':57B,95C 'misconfigur':82C 'org.apache.gravitino':24A 'packag':38B 'pv9v':20A 'read':10A,59B,98C 'recommend':104C 'self':40B 'self-host':39B 'server':65B 'sql':72B,81C 'tie':68B 'truncat':12A,61B,100C 'ui':54B,86C 'upgrad':106C 'user':58B,96C,102C 'valid':5A,48B 'version':77B,88C,108C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Gravitino between 0.5.0 and 1.0.0 that expose its UI to users who can create or edit JDBC catalogs. The sources describe the risk as coming from a malicious user of the UI, so deployments with only trusted administrators or no UI exposure are lower risk. Teams on 1.0.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apachegravitino","gravitino","orgapachegravitinocatalogjdbccommon"],"ptokens":["apache","catalog","common","gravitino","jdbc","org"],"labels":["apachegravitino","cwe89","java","jdbc","maven","medium","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T14:16:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7ph3-grqh-pv9v","url":"https://github.com/advisories/GHSA-7ph3-grqh-pv9v","severity":"medium","published_at":"2026-06-30T15:30:46+00:00","modified_at":"2026-11-05T18:05:13+00:00","first_seen_at":"2026-11-05T18:09:54+00:00","fetched_at":"2026-11-05T18:16:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-53648","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53648","severity":null,"published_at":"2026-06-30T14:16:24+00:00","modified_at":"2026-09-29T19:10:00+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null}],"documents":[{"id":78458,"url":"https://github.com/apache/gravitino/pull/8000","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78459,"url":"https://github.com/apache/gravitino/commit/5355bd075d54cad1323606723e72cc32ca564f24","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78460,"url":"https://github.com/apache/gravitino/releases/tag/v1.0.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":78705,"url":"https://lists.apache.org/thread/s0hytcv17z52dwp5dojjjwgrtqtyh2xk","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":78706,"url":"http://www.openwall.com/lists/oss-security/2026/06/30/2","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"exploit_sources":[{"type":"epss","score":0.00561,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-53648"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}