CVE-2026-44615

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44615

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44615.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44615

Published

2026-07-31T11:05:07.878Z

Modified

2026-08-02T03:47:26.439525623Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Path traversal in NotebookRepo note and folder path composition

Details

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44615.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "apache"
}

References

Affected packages

Git / github.com/apache/zeppelin

Affected ranges

Type

GIT

Repo

https://github.com/apache/zeppelin

Events

Introduced

ecc4455b1809c01cd17b542273be37fb1ebad8d4

Fixed

ae9cb72ffaa6b3c007f57b152e2a3eb2208b910a

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.12.1"
        },
        {
            "fixed": "0.12.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44615.json"