RisingWave versions earlier than 3.1.0 suffer from a missing authorization flaw that lets a user with CREATE privilege on a schema configure posix_fs sources or fs sinks to point to any directory on the server. The defective logic does not enforce access control on the root or path parameters, resulting in the ability to read sensitive configuration files or write files with root privileges, effectively enabling a privilege escalation scenario.

The vulnerability affects RisingWave releases prior to 3.1.0. Users running any community or enterprise version of RisingWave from the inception of the posix_fs and fs connectors up through 3.0.x are impacted. No specific patch version numbers are listed beyond 3.1.0, which is indicated as a fix release in the advisory.

With a CVSS score of 7.1 the flaw falls into the Medium‑High severity range. The exploit requires only a SQL user with schema CREATE rights, a capability commonly granted to low‑privileged database roles, implying that an attacker who can inject SQL commands but lacks higher privileges can abuse the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation is not yet documented. Nonetheless, the combination of broad user permissions and lack of file‑system access checks makes this a potentially high‑impact scenario for compromised or mis‑configured database accounts.