CVE-2025-61734: 
Java vulnerability analysis and mitigation

CVE-2025-61734 is a Files or Directories Accessible to External Parties vulnerability affecting Apache Kylin versions 4.0.0 through 5.0.2. The vulnerability was disclosed on October 2, 2025, and has been assigned a CVSS v3.1 base score of 7.5 (HIGH) (NVD, Security Online).

The vulnerability is classified under CWE-552 (Files or Directories Accessible to External Parties). It has been assigned a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, no user interaction needed, unchanged scope, and potential for high confidentiality impact (NVD).

If exploited, attackers with sufficient access could retrieve sensitive files from the system, potentially leading to data leakage or reconnaissance for further attacks. However, the impact is limited as long as the Kylin's system and project admin access is well protected (Security Online).

Users are strongly recommended to upgrade to Apache Kylin version 5.0.3, which contains fixes for this vulnerability. The upgrade is the primary and most effective mitigation strategy (Security Online).