Executive brief
Apache Zeppelin is a web-based notebook used for data exploration and analysis. A security flaw in how it handles file paths allows an authorized user to bypass directory restrictions. This could allow an attacker to move, modify, or delete sensitive files on the server's filesystem or connected Hadoop storage, potentially leading to data loss or system instability.
Technical details
A path traversal vulnerability exists in Apache Zeppelin's FileSystemNotebookRepo component. When processing note renames or folder operations, the application fails to properly sanitize user-supplied path segments, allowing the inclusion of traversal sequences (e.g., '../'). An authenticated attacker with permissions to rename notes or manage folders can exploit this to manipulate files outside the designated notebook directory using the server's filesystem or Hadoop identity. The vulnerability also affects object-store backends like S3, Azure, and GCS that build keys directly from user strings. The issue is resolved in version 0.12.1 by implementing recursive URL-decoding and strict validation of path segments.
Affected products
- Apache Software Foundation Zeppelin 0.9.0 through 0.12.0
Timeline
- 2026-05-14: patched: Fix merged into master and 0.12 branches
- 2026-07-31: disclosed: CVE-2026-44615 published