CVE-2020-17518

Confirmed PUBLISHED

Apache Flink directory traversal attack: remote file writing through the REST API

Apache Software Foundation · Apache Flink

Not yet in CISA KEV

Exploited in the wild Active exploitation observed PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

7.5 High EPSS 50.0%

At a Glance

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

nuclei_scanner apache

CVE Published: Jan 05, 2021
Exploitation Reported: Jun 12, 2026
CVSS: 7.5 High
EPSS: 50.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache Flink	Apache Flink 1.5.1 to 1.11.2	Affected

CVE References

[flink-user] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a181...
[announce] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a181...
[oss-security] 20210105 [CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/01/05/1
[flink-issues] 20210106 [GitHub] [flink-web] zentol commented on a change in pull request #408: Add security page for Flink lists.apache.org · Mailing List https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe7575601...
[flink-dev] 20210106 [jira] [Created] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rd6a1a0e2d73220a65a8f6535bbcd24b...

Show 19 more references

[flink-issues] 20210106 [jira] [Created] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r8167f30c4c60a11b8d5be3f55537bee...
[flink-issues] 20210107 [jira] [Updated] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r0b000dc028616d33cb9aa388eb45d51...
[flink-issues] 20210107 [jira] [Closed] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r705fb2211b82c9f1f8d2b1d4c823bcb...
[flink-issues] 20210107 [jira] [Commented] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r5444acac3407ef6397d6aef1b5aec2d...
[flink-issues] 20210112 [jira] [Commented] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r710693b0d3b229c81f485804ea1145b...
[flink-dev] 20210113 Re: [DISCUSS] Releasing Apache Flink 1.10.3 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b...
[flink-issues] 20210114 [jira] [Reopened] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rfe159ccf496d75813f24c6079c5d338...
[flink-issues] 20210114 [jira] [Commented] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r7b2ee88c66fc1d0823e66475631f5c3...
[flink-issues] 20210114 [jira] [Closed] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rec0d650fbd4ea1a5e1224a347d83a63...
[flink-issues] 20210114 [jira] [Updated] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf8812a5703f4a5f1341138baf239258...
[flink-issues] 20210114 [jira] [Comment Edited] (FLINK-20875) Could patch CVE-2020-17518 to version 1.10 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rcb9e8af775f2a3706b69153aefde78f...
[flink-issues] 20210114 [jira] [Updated] (FLINK-20875) [CVE-2020-17518] Directory traversal attack: remote file writing through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/r88200d2f0b620c6b4b1585a71713550...
[flink-issues] 20210114 [jira] [Commented] (FLINK-20875) [CVE-2020-17518] Directory traversal attack: remote file writing through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/r4a87837518804b31eb9db3048347ed2...
[flink-dev] 20210115 Re: [DISCUSS] Releasing Apache Flink 1.10.3 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb...
[flink-dev] 20210121 Re: [VOTE] Release 1.10.3, release candidate #1 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rd2467344f88bcaf108b8209ca92da8e...
[announce] 20210125 Apache Software Foundation Security Report: 2020 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942...
[announce] 20210223 Re: Apache Software Foundation Security Report: 2020 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b5...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a181...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-12-05 00:00 UTC
KEVIntel	2026-07-03 12:36 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 3
Distinct User-Agents: 42

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17518.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0 5.0 Medium

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-06-12 00:32:43 UTC · KEVIntel

Active exploitation observed

Recorded 2026-06-12 00:32:43 UTC · KEVIntel sensor

Proof of concept available

Recorded 2021-01-06 13:40:06 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23

Relative Path Traversal

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17518.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

murataydemir/CVE-2020-17518

github · Created 2021-01-10 01:12:45 UTC · 3 stars

[CVE-2020-17518] Apache Flink RESTful API Arbitrary File Upload via Directory Traversal

QmF0c3UK/CVE-2020-17518

github · Created 2021-01-06 13:40:06 UTC · 7 stars

Apache Flink 1.5.1 - Local File Inclusion

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-17518

{
  "cve_id": "CVE-2020-17518",
  "title": "Apache Flink directory traversal attack: remote file writing through the REST...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Flink",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.50038,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-17518

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 38 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API