Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/seatunnel

              dev @ 4690b6b
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

seatunnel-engine-server: most-fixed (4 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: REST command execution was historically accepted by inactive standby nodes instead of enforcing processing exclusively on the active master node, allowing potential state-altering actions to bypass architectural topology guards.

Path Traversal: Archive decompression operations did not validate the output target pathways constructed from ZIP entries, exposing the system to arbitrary file writes (Zip Slip) via 'FileOutputStream'.

Path Traversal: REST log retrieval endpoints failed to verify path boundaries before reading files, allowing attackers to traverse outside the designated logging directory base path.