Upload of file to arbitrary path in Apache Flink
Published Jan 5, 2021 · Updated Oct 22, 2026 · Also known as GHSA-7q5g-gph2-4rc6, BIT-flink-2020-17518
Original summary
Normalized public record · Updated Oct 22, 2026
Upload of file to arbitrary path in Apache Flink
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- 15%
- Aliases
- GHSA-7q5g-gph2-4rc6, BIT-flink-2020-17518
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- lists.apache.org ↗
- [flink-user] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API ↗
- [announce] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API ↗
- [oss-security] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API ↗
- [flink-issues] 20210106 [GitHub] [flink-web] zentol commented on a change in pull request #408: Add security page for Flink ↗
- [flink-dev] 20210106 [jira] [Created] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-issues] 20210106 [jira] [Created] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-issues] 20210107 [jira] [Updated] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-issues] 20210107 [jira] [Closed] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-issues] 20210107 [jira] [Commented] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-issues] 20210112 [jira] [Commented] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 ↗
- [flink-dev] 20210113 Re: [DISCUSS] Releasing Apache Flink 1.10.3 ↗
Record history
Published Jan 5, 2021 · Last refreshed Oct 22, 2026