CVE-2026-41041
Critical · 9.1CVSS
9.1
EPSS
—
Published
Jul 13, 2026
CISA due date
—
The record
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177
- CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
- GHSA-x428-ghpx-8j92 @fastify/static vulnerable to route guard bypass via encoded path separators CWE-177
- CVE-2026-6414 @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F)… CWE-177
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-177
- GHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability CWE-177
- GHSA-g6q3-96cp-5r5m @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) CWE-177
- GHSA-cxrg-g7r8-w69p Fastify Middie Middleware Path Bypass CWE-177