CVE-2025-29847: 
Java vulnerability analysis and mitigation

CVE-2025-29847 is an arbitrary file read vulnerability in Apache Linkis, named "Arbitrary File Read via Double URL Encoding Bypass." When using the JDBC engine and data source functionality, a URL parameter configured on the frontend that has undergone multiple rounds of URL encoding can bypass the system's input validation checks, allowing unauthorized access to system files via JDBC parameters. The vulnerability affects Apache Linkis versions 1.3.0 through 1.7.0 and was publicly disclosed on September 19, 2025 via the oss-security mailing list, with NVD publication on January 19, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (oss-security, Feedly).

The root cause is improper input validation (CWE-20) combined with path traversal (CWE-22), specifically a failure to iteratively decode URL-encoded input before applying security checks. When a JDBC connection URL parameter is double- or multi-encoded (e.g., % encoded as %25), the system's single-pass validation does not detect malicious path traversal sequences, allowing the encoded payload to reach the JDBC driver and read arbitrary files from the server's filesystem. The attack is network-accessible, requires no authentication, no user interaction, and has low attack complexity, making it exploitable by any remote unauthenticated attacker who can reach the Linkis frontend. The fix involves continuously checking for the % character in connection information and performing URL decoding until no encoded characters remain (oss-security, Feedly).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem via crafted JDBC URL parameters, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive files such as configuration files, credentials, private keys, or application secrets stored on the Linkis server could be exfiltrated, potentially enabling further lateral movement or privilege escalation within the environment. The scope is limited to the affected Linkis instance, but the exposure of credentials or keys could extend the blast radius significantly (oss-security, Feedly).

1. Reconnaissance: Identify internet-facing Apache Linkis instances (versions 1.3.0–1.7.0) using tools like Shodan or Censys, or by fingerprinting the Linkis web frontend.
2. Access JDBC data source configuration: Navigate to the Linkis frontend's data source management interface, which allows configuration of JDBC connection parameters including the URL field.
3. Craft a double-encoded payload: Construct a JDBC URL parameter containing a path traversal sequence that has been URL-encoded multiple times (e.g., encode ../ as %2E%2E%2F, then encode % as %25 to produce %252E%252E%252F), targeting a sensitive file such as /etc/passwd or application configuration files.
4. Submit the malicious URL: Configure or submit the crafted JDBC URL via the frontend. The system's single-pass validation fails to detect the traversal sequence after decoding only one layer.
5. Retrieve file contents: The JDBC engine processes the decoded URL and reads the targeted file, returning its contents to the attacker through the application's response or error output (oss-security, Feedly).

• Network: Unusual HTTP requests to Linkis data source or JDBC configuration endpoints containing double-encoded characters (e.g., %25 sequences) in URL parameters; unexpected outbound connections from the Linkis server to unknown hosts.
• Logs: Linkis application logs showing JDBC connection attempts with URL parameters containing %25 or multiple % sequences; repeated access to data source configuration APIs from unexpected source IPs.
• File System: Evidence of file read operations on sensitive paths (e.g., /etc/passwd, /etc/shadow, application config files) initiated by the Linkis service account; unexpected access timestamps on sensitive files.
• Process: Linkis service processes accessing files outside expected application directories.

Users should upgrade Apache Linkis to version 1.8.0, which resolves the vulnerability by iteratively checking for and decoding URL-encoded characters in JDBC connection parameters. As a workaround prior to upgrading, administrators should ensure that any JDBC URL parameters submitted via the frontend are validated by continuously checking for the % character and performing URL decoding until no encoded sequences remain. Restricting access to the Linkis frontend and JDBC data source configuration interfaces to trusted networks or authenticated users can also reduce exposure (oss-security, Feedly).

The vulnerability was disclosed by researchers Le1a and A1kaid from Threatbook, with the official advisory posted to the oss-security mailing list on September 19, 2025. Social media activity was observed on Bluesky and Mastodon, with security community accounts sharing the CVE details. Coverage was also noted in aggregator platforms such as VulDB and security news outlets (oss-security).