CVE-2025-2298 is an improper authorization vulnerability in Dremio Software that allows authenticated users to delete arbitrary files, including system files and those stored in remote locations like S3 or Azure Blob Storage. This flaw stems from insufficient access controls on an API endpoint, enabling users to delete files outside their intended scope. With a CVSS score of 8.4 (HIGH), exploitation could lead to significant data loss, denial of service, and potential impact escalation. While no active exploitation or public exploit code has been identified, and community discussion is minimal, organizations using affected Dremio versions (below 24.0.0, specific 24.3.x, 25.0.x, 25.1.x, and 25.2.x branches) should update to fixed versions (24.3.17+, 25.0.15+, 25.1.8+, 25.2.5+, or 26.0.0+) to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Dremio Corporation | Dremio Software | >= 24.3.0, <= 24.3.17, >= 25.0.0, <= 25.0.15, >= 25.1.0, <= 25.1.7, >= 25.2.0, <= 25.2.4CNA affecteddefault affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.