Apache Parquet Java up to 1.15.1 parquet-avro file inclusion

Summaryinfo

A vulnerability was found in Apache Parquet Java up to 1.15.1. It has been classified as critical. This issue affects some unknown processing of the component parquet-avro Module. Performing a manipulation results in Remote Privilege Escalation. This vulnerability is cataloged as CVE-2025-46762. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Apache Parquet Java up to 1.15.1. This affects an unknown code block of the component parquet-avro Module. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-46762 since 04/29/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/02/2026).

The vulnerability scanner Nessus provides a plugin with the ID 242270 (Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.15.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242270) and CERT Bund (WID-SEC-2025-2940). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Pega Platform

Productinfo

Type

• Programming Language Software

Vendor

• Apache

Name

• Parquet Java

Version

• 1.15.0
• 1.15.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion