Executive brief
Apache Kvrocks, a distributed database compatible with the Redis protocol, is affected by a path traversal vulnerability. This flaw could allow a high-privileged user to access or manipulate files outside of the intended directory, potentially impacting system stability or data integrity. Organizations using affected versions should upgrade to version 2.16.0 to mitigate this risk.
Technical details
A relative path traversal vulnerability (CWE-23) exists in Apache Kvrocks from version 1.0.0 through 2.15.0. The vulnerability allows an attacker with high privileges to bypass directory restrictions via specially crafted file paths. According to the CVSS 4.0 vector, the attack requires local access, high privileges, and some degree of user interaction. Successful exploitation could lead to limited loss of confidentiality, integrity, and availability. The issue is addressed in Apache Kvrocks version 2.16.0.
Affected products
- Apache Kvrocks 1.0.0 through 2.15.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched: Fixed in version 2.16.0