Path Traversal Vulnerability in Apache Kyuubi by Apache

CVE-2026-52680

What is CVE-2026-52680?

Apache Kyuubi has a vulnerability in its REST batch multipart upload handling, which allows a remote attacker to exploit the client-supplied multipart filename. By using path traversal sequences in the filename, the attacker can manipulate the Kyuubi server process into writing unauthorized content outside of the designated upload directory. This vulnerability affects several versions of Apache Kyuubi from 1.7.0 through 1.11.1, prompting users to upgrade to version 1.12.0 to mitigate the risk.

References