EUVD-2026-51185
GHSA-h9qj-gx4p-69cp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable REST endpoint with no required auth/UI (AV:N/AC:L/PR:N/UI:N); core impact is arbitrary controlled file write (I:H), with only escalation-dependent confidentiality/availability effects (C:L/A:L).
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart upload endpoint, which trusts the client-supplied filename, to plant controlled content anywhere the server process can write. Because the server never sanitizes path traversal sequences (../) in the multipart filename, an attacker can escape the intended upload directory and overwrite or create files subject only to filesystem permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to Apache Kyuubi's REST API batch submission (multipart upload) endpoint on an affected version (1.7.0-1.11.1); the attacker must be able to send a multipart/form-data request with a crafted 'filename' containing path traversal sequences. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and warrant a nuanced priority call. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Kyuubi REST batch upload endpoint submits a multipart POST whose file part sets filename to something like '../../../../opt/kyuubi/conf/malicious' or a path that later gets executed or sourced by the service. The server writes the attacker-controlled bytes outside the upload directory, and if the process has write access to a script, config, or web-served location, the attacker can pivot to configuration tampering or code execution. … |
| Remediation | Vendor-released patch: upgrade to Apache Kyuubi 1.12.0, which fixes the filename handling - this is the primary and recommended remediation per the Apache advisory (https://lists.apache.org/thread/b0qx2v8k5v4rrqsh53pb146t7so0lmrk). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Kyuubi deployments and versions running by querying asset inventory and process listings (rpm, dpkg, or runtime inspection), and immediately implement network controls restricting REST API access (port 10099) to authorized internal clients only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today