What’s Vulnerable › Vulnerabilities

CVE-2021-28655: Apache Zeppelin: Arbitrary file deletion vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-16 · updated 2026-06-17
• Weakness: CWE-20

Description

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.

Affected products

• Apache Software Foundation Apache Zeppelin: through 0.9.0

References

• https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2
• https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2

Get alerted when CVE-2021-28655 or the next vulnerability affects your stack