CVE-2025-53648: 
Homebrew Análise e mitigação de vulnerabilidades

CVE-2025-53648 is a SQL injection vulnerability (CWE-89) in the Apache Gravitino UI, classified as an SQL misconfiguration, that allows authenticated low-privileged users to read or truncate files on the affected system. It affects Apache Gravitino versions 0.5.0 through below 1.0.0 (specifically the org.apache.gravitino:catalog-jdbc-common component). The vulnerability was publicly disclosed on June 30, 2026, via the Apache security mailing list and oss-security. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Apache Advisory).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), described as an "SQL misconfiguration" in the Gravitino UI component. An authenticated attacker with low privileges can craft malicious input that is incorporated into SQL queries without adequate sanitization, enabling file read or truncation operations on the underlying system — consistent with SQL features such as LOAD DATA INFILE or SELECT INTO OUTFILE in certain database backends. The attack vector is network-accessible, requires no user interaction, and has low attack complexity, but does require a valid (low-privileged) account. No public proof-of-concept code has been identified at this time (oss-security, GitHub Advisory).

Successful exploitation allows a malicious authenticated user to read arbitrary files accessible to the database process or truncate files, resulting in limited confidentiality and integrity impacts. Availability is not directly impacted per the CVSS scoring, though file truncation could cause data loss or service disruption for dependent components. The scope is unchanged, meaning the impact is confined to the vulnerable Gravitino component and its underlying file system access (GitHub Advisory, oss-security).

Apache has released version 1.0.0 of Gravitino, which fixes this vulnerability. All users running versions 0.5.0 through below 1.0.0 are strongly recommended to upgrade to version 1.0.0 immediately. No specific configuration-based workarounds have been published; upgrading is the primary remediation (Apache Advisory, oss-security).

The vulnerability was disclosed by Jerry Shao via the oss-security mailing list on June 30, 2026, crediting the GreatBook VulTeam as the finders and reporters. The GitHub Advisory Database has classified it as "Moderate" severity. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (oss-security, GitHub Advisory).