CVE-2026-52680 in Kyuubi
Summary
by MITRE • 07/30/2026
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions.
This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in Apache Kyuubi REST batch multipart upload functionality represents a critical path traversal flaw that allows remote attackers to manipulate file system operations through crafted client-supplied filenames. This security weakness exists within the server's handling of multipart form data submissions and specifically impacts versions ranging from 1.7.0 through 1.11.1. The core issue stems from the server's failure to properly sanitize or validate filename inputs before using them to determine temporary file storage locations, creating an opportunity for attackers to bypass intended directory boundaries.
The technical implementation of this vulnerability involves the kyuubi server process directly incorporating user-provided filename components into its temporary file path construction without adequate sanitization measures. When a remote attacker submits a multipart form upload request containing malicious filename sequences such as ../ or ..\, these path traversal elements are processed verbatim and used to determine where temporary files should be created on the filesystem. This behavior violates fundamental security principles of input validation and privilege separation, allowing attackers to potentially write files outside of designated upload directories.
This vulnerability has significant operational implications for organizations using Apache Kyuubi as their batch processing platform. The ability to write arbitrary content to locations outside intended upload directories creates multiple attack vectors including potential code execution through malicious file placement, data exfiltration via unauthorized file system access, and system compromise through privilege escalation opportunities. The impact extends beyond simple file corruption as attackers could potentially manipulate the server's operational environment by placing files in critical system directories or leveraging the temporary file creation mechanism for persistence.
The vulnerability maps directly to CWE-22 Path Traversal and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables attackers to execute arbitrary commands through manipulated file placement. Additionally, this issue demonstrates characteristics of T1566 Impair Defenses by potentially allowing attackers to modify system files or directories that should be protected from unauthorized access. Organizations running affected versions face risks of unauthorized data access, system integrity compromise, and potential escalation to full system control depending on the server's filesystem permissions and user privileges.
The recommended mitigation involves upgrading to Apache Kyuubi version 1.12.0 which implements proper filename sanitization and validation mechanisms to prevent path traversal sequences from being processed in temporary file creation operations. Security teams should also consider implementing additional protective measures such as restricting network access to the REST batch upload endpoints, monitoring for suspicious file creation patterns, and validating filesystem permissions on upload directories to limit potential impact of any remaining vulnerabilities. Organizations should conduct thorough security assessments of their kyuubi deployments to ensure complete remediation across all affected versions and configurations.