PT-2026-66517 · Apache · Apache Kyuubi
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Kyuubi versions 1.7.0 through 1.11.1
Description
Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled content outside the intended upload directory, depending on filesystem permissions, via the REST batch upload endpoint.
Recommendations
Upgrade to version 1.12.0.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Kyuubi