{"id":"GHSA-7ph3-grqh-pv9v","summary":"Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation","details":"SQL misconfiguration in the Gravitino UI, in versions 0.5.0 until 1.0.0, can allow a malicious user to read or truncate files.\nUsers are recommended to upgrade to version 1.0.0, which fixes this issue.","aliases":["CVE-2025-53648"],"modified":"2026-11-05T18:15:03.892894785Z","published":"2026-06-30T15:30:46Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-11-05T18:05:11Z","nvd_published_at":"2026-06-30T14:16:24Z","cwe_ids":["CWE-89"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53648"},{"type":"WEB","url":"https://github.com/apache/gravitino/pull/8000"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/10102"},{"type":"WEB","url":"https://github.com/apache/gravitino/commit/5355bd075d54cad1323606723e72cc32ca564f24"},{"type":"PACKAGE","url":"https://github.com/apache/gravitino"},{"type":"WEB","url":"https://github.com/apache/gravitino/releases/tag/v1.0.0"},{"type":"WEB","url":"https://lists.apache.org/thread/s0hytcv17z52dwp5dojjjwgrtqtyh2xk"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/30/2"}],"affected":[{"package":{"name":"org.apache.gravitino:catalog-jdbc-common","ecosystem":"Maven","purl":"pkg:maven/org.apache.gravitino/catalog-jdbc-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"1.0.0"}]}],"versions":["0.6.0-incubating","0.6.1-incubating","0.7.0-incubating"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}