Executive brief
Apache Kyuubi, a distributed multi-tenant gateway for data processing engines, contains a vulnerability in how it handles file uploads. An attacker with access to the batch upload interface can use specially crafted filenames to save files in unauthorized locations on the server's filesystem. This could allow an attacker to overwrite sensitive system files or plant malicious data, potentially disrupting operations or compromising the server's integrity.
Technical details
A path traversal vulnerability exists in Apache Kyuubi's REST batch multipart upload endpoint. The application fails to properly sanitize client-supplied filenames when creating temporary uploaded resources, allowing the use of traversal sequences (e.g., ../). A remote attacker with access to the REST batch upload endpoint can exploit this to write arbitrary content to locations outside the designated upload directory, constrained only by the filesystem permissions of the Kyuubi server process. The issue is resolved in version 1.12.0.
Affected products
- Apache Kyuubi 1.7.0 through 1.11.1
Timeline
- 2026-07-30: disclosed: Public advisory released by Apache Software Foundation
- 2026-07-30: advisory: NVD publication date