Vulnerability Report

CVE-2026-52680

Title: Apache Kyuubi Path Traversal Vulnerability

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2026-52680

CWE Category CWE-22

Published Date Jul 30, 2026

Modified Date Aug 05, 2026

Exploit Status Available

Score 9.8 CVSS v

Exploit Probability (EPSS)

0.75%

Vulnerability Summary

CVE-2026-52680: Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Impacted Vendors

apache 1

Reference Links

https://lists.apache.org/thread/b0qx2v8k5v4rrqsh53pb146t7so0lmrk

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns