Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2025-66518

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-f8r6-6222-9pvc

Apache Kyuubi Server vulnerable to Path Traversal Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

gitlab/maven/org.apache.kyuubi/kyuubi-server_2.12/CVE-2025-66518

Apache Kyuubi Server vulnerable to Path Traversal Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.