CVE-2025-2298 Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software
Authenticated users can delete arbitrary files via an API endpoint, causing data loss and denial of service in Dremio Software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2298?
CVE-2025-2298 is a high-severity missing authorization vulnerability in Dremio Software, published on 21 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to insufficient access controls on an API endpoint, enabling any authenticated user to specify and delete files outside their intended scope. Exploiting this flaw could lead to data loss, denial of service (DoS), and potential escalation of impact depending on the deleted files.
Affected versions: * Any version of Dremio below 24.0.0
* Dremio 24.3.0 - 24.3.16
* Dremio 25.0.0 - 25.0.14
* Dremio 25.1.0 - 25.1.7
* Dremio 25.2.0 - 25.2.4
Fixed in version: * Dremio 24.3.17 and above
* Dremio 25.0.15 and above
* Dremio 25.1.8 and above
* Dremio 25.2.5 and above
* Dremio 26.0.0 and above
Weakness: CWE-862
Which versions are affected by CVE-2025-2298?
How do I fix CVE-2025-2298?
No fix has been published for CVE-2025-2298 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-2298 being exploited?
There is no known exploitation of CVE-2025-2298 in the wild and no public exploit code.
Sources
Also known as GHSA-7rh8-vj62-qfcg.