Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

A vulnerability in Apache Linkis (CVE-2025-29847) affects the JDBC engine and data source functionality. The issue arises when a URL parameter configured on the frontend undergoes multiple rounds of URL encoding, which can bypass the system's input validation checks [2][3]. This encoding discrepancy allows an attacker to inject malicious JDBC parameters that evade the intended filtering mechanisms.

An attacker can exploit this vulnerability by crafting a specially encoded JDBC URL. The bypass relies on the fact that the system does not properly decode the URL after multiple encoding iterations, leading to the acceptance of malicious parameters that would otherwise be blocked [3]. No authentication is required if the attacker can supply the JDBC connection string through the frontend interface

Successful exploitation allows unauthorized access to system files via JDBC parameters, potentially leading to sensitive data exposure [2][3]. The vulnerability is rated as moderate severity and affects Apache Linkis versions from 1.3.0 through 1.7.0

The recommended mitigation is to upgrade to Apache Linkis version 1.8.0, which fixes the issue. As a temporary workaround, administrators should continuously check if connection information contains the '%' character and perform URL decoding where necessary [2][3].