EUVD-2026-30703
GHSA-cpvr-wrmg-c3qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_sessions.py of the component Delete Request Handler. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in adenhq Hive versions up to 0.11.0 allows unauthenticated remote attackers to read arbitrary files via the _read_events_tail function in the Delete Request Handler. This network-accessible vulnerability requires no user interaction and has a publicly available proof-of-concept exploit. The vendor has not responded to disclosure attempts, leaving users without an official patch. EPSS data unavailable; CVSS 5.5 reflects limited confidentiality/integrity impact but ease of exploitation warrants prioritization for internet-facing deployments.
Technical ContextAI
This vulnerability affects adenhq Hive (cpe:2.3:a:adenhq:hive:*:*:*:*:*:*:*:*), specifically the _read_events_tail function within core/framework/server/routes_sessions.py in the Delete Request Handler component. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. This class of vulnerability occurs when user-supplied input is inadequately validated before being used to construct file paths, allowing attackers to use special character sequences (like '../') to escape intended directory boundaries. In web applications like Hive, which appears to be a session management or event processing framework, unsanitized file path inputs to functions reading event logs or session data can grant unauthorized filesystem access beyond the application's working directory.
RemediationAI
No official vendor patch exists due to vendor non-responsiveness. Organizations should immediately implement compensating controls: First, restrict network access to Hive instances using firewall rules or network segmentation to trusted IP ranges only, eliminating unauthenticated internet exposure. Second, deploy a web application firewall (WAF) with path traversal detection rules to block requests containing directory traversal sequences ('../', '..\', URL-encoded variants) targeting the affected endpoint. Third, review application logs for suspicious requests to routes_sessions.py endpoints showing parent directory sequences. Fourth, monitor the Hive GitHub repository (github.com/adenhq) and VulDB (https://vuldb.com/vuln/364384) for community patches or forks addressing CVE-2026-8757. If Hive is not business-critical, consider migrating to an actively maintained alternative session management framework. Note that WAF rules may cause false positives with legitimate file paths containing encoded characters; test rules in monitor mode before enforcing. Network restrictions will prevent legitimate remote users from accessing the application unless VPN access is provided.
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authentici
This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the
The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against mali
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). R
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere Big
SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thr
Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking pol
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved
In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/mali
In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xp
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today