GHSA-f8r6-6222-9pvc

Source

https://github.com/advisories/GHSA-f8r6-6222-9pvc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-f8r6-6222-9pvc/GHSA-f8r6-6222-9pvc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f8r6-6222-9pvc

Aliases

CVE-2025-66518

Published

2026-01-05T09:30:19Z

Modified

2026-01-05T20:26:26.680364Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L CVSS Calculator

Summary

Apache Kyuubi Server vulnerable to Path Traversal

Details

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.

This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.

Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

Database specific

{
    "severity": "HIGH",
    "github_reviewed_at": "2026-01-05T19:57:06Z",
    "cwe_ids": [
        "CWE-27"
    ],
    "nvd_published_at": "2026-01-05T09:15:54Z",
    "github_reviewed": true
}

References

Affected packages

Maven / org.apache.kyuubi:kyuubi-server_2.12

Package

Name: org.apache.kyuubi:kyuubi-server_2.12; View open source insights on deps.dev
Purl: pkg:maven/org.apache.kyuubi/kyuubi-server_2.12

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.6.0

Fixed

1.10.3

Affected versions

1.*

1.6.0-incubating

1.6.1-incubating

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.10.0

1.10.1

1.10.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-f8r6-6222-9pvc/GHSA-f8r6-6222-9pvc.json"