CVE-2025-66518
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
- EPSS probability
- 1.05%
- CWE
- CWE-27
- Published
- 2026-01-05
- Last modified
- 2026-03-13
Affected products
- Apache Software Foundation Apache Kyuubi
Weakness type
Related vulnerabilities
- CVE-2026-76344 — Path Traversal through the Search Dispatch REST API in Splunk Enterprise
- CVE-2026-62391 — Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases
- CVE-2026-24457 — An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from...
- CVE-2026-20018 — Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability
- CVE-2025-58292 — Denial of service (DoS) vulnerability in the office service. Successful exploitation of this...
- CVE-2025-10438 — Path Traversal in Yordam BT's Yordam Katalog
- CVE-2025-58761 — Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
- CVE-2024-43658 — Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.