CVE-2024-48988 Apache StreamPark: SQL injection vulnerability

High 7.6 Published 22 Aug 2025 Updated 4 Nov 2025

Authenticated attackers can exploit SQL injection in Apache StreamPark to read or modify database contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-48988?

CVE-2024-48988 is a high-severity SQL injection vulnerability in Apache StreamPark, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SQL Injection vulnerability in Apache StreamPark.

This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.

Users are recommended to upgrade to version 2.1.6, which fixes the issue.

This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts. It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). As a result, the associated risk is considered relatively low.

Weakness: CWE-89, CWE-564

Which versions are affected by CVE-2024-48988?

It affects 1 product.

Products include Apache Streampark.

How do I fix CVE-2024-48988?

No fix has been published for CVE-2024-48988 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-48988 being exploited?

There is no known exploitation of CVE-2024-48988 in the wild and no public exploit code.

Sources

Also known as GHSA-6wpf-q5x2-66fc.