CVE-2026-44615

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.9.0 through 0.12.0

Description A path traversal issue exists when FileSystemNotebookRepo is configured. An authenticated attacker with permissions to rename a note or perform folder operations can provide traversal segments in note or folder paths. The system composes these values into filesystem paths using the server's filesystem or Hadoop identity without verifying that the resulting path remains within the configured notebook directory. This allows notebook files or directories to be moved, written, or deleted outside the notebook root.

Recommendations Upgrade to version 0.12.1.