CVE-2025-29847 is a security vulnerability identified in Apache Linkis, an open-source data integration and governance platform maintained by the Apache Software Foundation. The flaw exists in the handling of URL parameters within the JDBC engine and data source functionality. Specifically, when the URL parameter is subjected to multiple rounds of URL encoding, it can bypass the system's input validation checks. This improper input validation (CWE-20) combined with potential path traversal issues (CWE-22) allows an attacker to craft malicious JDBC parameters that may grant unauthorized access to system files. The vulnerability affects Apache Linkis versions from 1.3.0 up to and including 1.7.0. The root cause is that the system does not adequately decode URL-encoded characters before validating the input, allowing encoded payloads to evade detection. The recommended fix, implemented in version 1.8.0, involves continuously checking for the presence of the '%' character in connection information and performing URL decoding to ensure all encoded data is properly interpreted before validation. No public exploits have been reported, but the vulnerability could be leveraged in environments where Apache Linkis is exposed to untrusted users or inputs, potentially leading to unauthorized file access and information disclosure.

For European organizations, the impact of this vulnerability can be significant, especially for those relying on Apache Linkis for data integration and governance in critical infrastructure, finance, healthcare, or government sectors. Unauthorized access to system files via JDBC parameters could lead to exposure of sensitive configuration files, credentials, or other protected data, undermining confidentiality and potentially integrity if attackers modify files. This could facilitate further lateral movement or privilege escalation within affected networks. The vulnerability does not appear to directly enable remote code execution or denial of service, but the unauthorized file access risk alone is concerning. Organizations with publicly accessible or poorly segmented Linkis deployments are at higher risk. Additionally, regulatory frameworks such as GDPR impose strict requirements on data protection; a breach resulting from this vulnerability could lead to compliance violations and financial penalties.

European organizations should immediately upgrade Apache Linkis to version 1.8.0 or later, where the vulnerability is fixed. Until upgrade is possible, implement strict input validation and sanitization on all user-supplied JDBC parameters, ensuring multiple rounds of URL decoding are performed before validation. Restrict access to the Linkis frontend and JDBC engine interfaces to trusted networks and authenticated users only, minimizing exposure to untrusted inputs. Conduct thorough audits of existing JDBC connection configurations to detect any suspicious or malformed URL parameters. Employ network segmentation and monitoring to detect anomalous access patterns targeting Linkis services. Additionally, review and harden file system permissions to limit the impact of any unauthorized file access. Finally, maintain up-to-date backups and incident response plans to quickly recover from any exploitation attempts.