Path traversal in Apache Kyuubi REST batch multipart upload (CVE-2026-52680)

Apache Kyuubi's REST batch multipart upload handler uses the client-supplied filename without sanitization when creating temporary resources. A remote attacker with access to the REST batch upload endpoint can supply path traversal sequences in the filename to write controlled content to arbitrary locations on the filesystem, subject to the permissions of the Kyuubi server process. Affected versions: - Apache Kyuubi (org.apache.kyuubi:kyuubi-common) 1.7.0 through 1.11.1 We recommend updating to: 1.12.0. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/330 Details: https://vuln.today/cve/CVE-2026-52680