CVE-2025-66518
High · 8.9Apache Kyuubi Server vulnerable to Path Traversal
CVSS
8.9
EPSS
1.0%
Published
Jan 5, 2026
CISA due date
—
The record
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.kyuubi:kyuubi-server_2.12 | 1.6.0 | 1.10.3 |
| maven | org.apache.kyuubi/kyuubi-server_2.12 | 1.6.0 | 1.10.3 |
Related vulnerabilities
- GHSA-f8r6-6222-9pvc Apache Kyuubi Server vulnerable to Path Traversal Same vulnerability
- CVE-2026-17495 moment is a JavaScript date library for parsing, validating, manipulating, and formatting… CWE-27
- CVE-2026-76344 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-27
- CVE-2026-24457 An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary… CWE-27
- CVE-2026-20018 A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center… CWE-27
- CVE-2024-24809 Traccar is an open source GPS tracking system. CWE-27
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937