Not rated
CVE-2026-52680 Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary…
Description
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Kyuubi 1.7 | 1.7.0 → 1.11.1 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Kyuubi
The 4 CVEs of Apache Kyuubi →
CVE-2026-62391
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend…
Not rated
CVE-2026-23904
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A…
Not rated
CVE-2025-66518
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config…
8.8
High