A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture.
Apache Paimon's MySQL CDC synchronization actions (MySqlSyncTableAction / MySqlSyncDatabaseAction) pass user-supplied JDBC connection properties (jdbc.properties.*) into the source MySQL connection URL without sanitization. A user who defines a CDC action can set jdbc.properties.allowLoadLocalInfile=true and point the source at a MySQL server they control. The rogue server answers the connection with a LOCAL INFILE request and the Flink/Paimon CDC process reads arbitrary local files (configuration, keys, credentials) and sends them to the attacker. Setting jdbc.properties.autoDeserialize=true additionally causes a crafted server response to be Java-deserialized, resulting in remote code execution on the Flink TaskManager.