Skip to content
OpenAdvisories
High · 7.3 CVE-2025-30001 EUVD-2025-33706GHSA-6wwv-6mm3-pp76

Apache StreamPark: Authenticated users can trigger remote command execution

Published Oct 10, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache StreamPark Package: org.apache.streampark:streampark Ecosystem: Maven

Description

Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark.

This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.

Users are recommended to upgrade to version 2.1.6, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache StreamPark 2.1.4 – < 2.1.6 2.1.6

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.streampark:streampark <= 2.1.5 — GHSA-6wwv-6mm3-pp76

References