Apache Kylin versions from 4.0.0 up to 5.0.2 have a vulnerability that allows files or directories to be accessible to external parties. This issue can expose sensitive data if administrative access controls are not properly enforced. The vulnerability is fixed in version 5.0.3.