← Back to browse · API

CVE-2023-27602

Severity
CRITICAL
CVSS
9.8
EPSS
0.01996
Risk score
39.9
CISA KEV
No
PoC
No
Published
2023-04-10
Modified
2025-02-13
First seen
2026-08-07
Aliases
EUVD-2023-2177, GHSA-X84R-JRQM-3HJ8
Products
Apache Software Foundation:Apache Linkis 0 ≤1.3.1
Sources
euvd EUVD-2023-2177

Description

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2.  For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties `wds.linkis.workspace.filesystem.owner.check=true` `wds.linkis.workspace.filesystem.path.check=true`

References