Kyuubi
CVE-2025-66518
HIGH
GHSA-f8r6-6222-9pvc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.
This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.
Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
AnalysisAI
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. [CVSS 8.8 HIGH]
Technical ContextAI
Affects Kyuubi. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.
This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.
Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
RemediationAI
Update to version 1.10.3 or later. Restrict network access to the affected service where possible.
Server-Side Request Forgery (SSRF) and open-proxy behavior in Apache Kyuubi's Engine UI proxy exposes the Kyuubi server
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart uploa
Same weakness CWE-27 – Path Traversal: 'dir/../../filename'
View allShare
External POC / Exploit Code
Leaving vuln.today