In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.
We recommend users upgrade the version of Linkis to version 1.3.2.
For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties
wds.linkis.workspace.filesystem.owner.check=true
wds.linkis.workspace.filesystem.path.check=true
{ "nvd_published_at": "2023-04-10T08:15:00Z", "cwe_ids": [ "CWE-434" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-07-06T21:58:51Z" }