Critical · 9.8 CVE-2023-27602 EUVD-2023-2177GHSA-x84r-jrqm-3hj8

Apache Linkis publicsercice module unrestricted upload of file

Published Apr 10, 2023 · Updated Feb 13, 2025 · Assigned by apache

Description

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.

We recommend users upgrade the version of Linkis to version 1.3.2.

For versions

<=1.3.1, we suggest turning on the file path check switch in linkis.properties

`wds.linkis.workspace.filesystem.owner.check=true`
`wds.linkis.workspace.filesystem.path.check=true`

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Linkis	≤ 1.3.1	—

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.linkis:linkis	< 1.3.2	1.3.2	GHSA-x84r-jrqm-3hj8