CVE-2023-49198 is a high severity (CVSS 7.5) arbitrary file read flaw in Apache SeaTunnel, announced by Apache as affecting SeaTunnel Web 1.0.0. Attackers can read files on a MySQL server by changing options in the MySQL connection URL. Apache recommends upgrading to version 1.0.1.
What's affected
- Apache SeaTunnel Web 1.0.0, per the Apache announcement on the oss-security list on 21 August 2024. The record says Apache SeaTunnel 1.0.0, which is a naming difference, not a version difference.
- Fixed: version 1.0.1, per Apache.
- Source conflict on severity: Apache rates it important, while the record scores it 7.5 High. Both mean you should upgrade without delay.
- The announcement lists the MySQL URL options allowLoadLocalInfile, allowUrlInLocalInfile, allowLoadLocalInfileInPath and maxAllowedPacket as the settings that can be changed.
- Severity: the record gives CVSS 7.5, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Find any SeaTunnel Web deployment and check its version, which is normally visible in the distribution name or the application's about page. Version 1.0.0 is affected.
Then look at where users can enter or edit MySQL data source URLs. The weakness is that the connection URL accepts options that change how the MySQL driver handles local files. List which users can create or modify data sources, and what MySQL servers those data sources can point at.
Also check which files the MySQL service account can read on the database host.
What to do now
- Upgrade Apache SeaTunnel Web to 1.0.1 or later.
- Restrict who can create or edit data source connections to administrators.
- Review existing MySQL data source URLs for unexpected option settings such as the ones Apache names.
- Run the MySQL service account with the least file system access possible.
- Place the SeaTunnel Web console behind authentication and a network boundary.
Why it matters
The record classifies this as CWE-552 (Files or Directories Accessible to External Parties). MySQL drivers can be told to load local files, a feature intended for bulk loading. When an application lets users supply the connection URL, those users can switch on options that were meant to stay under the administrator's control, and the result is that files become readable.
The lesson applies beyond this product. Any tool that builds database connections from user input should allow only the options it needs. Data integration platforms connect to many systems, so each connection setting is part of the attack surface.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which product is affected, SeaTunnel or SeaTunnel Web?
Apache's announcement names Apache SeaTunnel Web 1.0.0. The record says Apache SeaTunnel 1.0.0. Check the web component.
Does the attacker need to be logged in?
The record's vector says no privileges are required. Do not rely on authentication to protect you, and upgrade.
Sources
Last reviewed: 19 October 2026.
