GHSA-c399-q49h-qwc8
High · 7.5CVSS
7.5
EPSS
—
Published
Jan 19, 2026
CISA due date
—
The record
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.linkis:linkis | 1.3.0 | 1.8.0 |
| maven | org.apache.linkis/linkis | 1.3.0 | 1.8.0 |
Related vulnerabilities
- CVE-2025-29847 Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass Same vulnerability
- CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177
- CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
- CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apache… CWE-177
- GHSA-x428-ghpx-8j92 @fastify/static vulnerable to route guard bypass via encoded path separators CWE-177
- CVE-2026-6414 @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F)… CWE-177
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-177
- GHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability CWE-177