Listen to this Post
The vulnerability is a path traversal bypass in the Apache Kyuubi Server’s file access controls. The server uses a configuration parameter `kyuubi.session.local.dir.allow.list` to restrict which local directories a client can access via Kyuubi frontend protocols. However, the validation logic is flawed. An attacker can submit a crafted request containing directory traversal sequences (e.g., ../../../etc/passwd) when specifying a local file path. The server incorrectly parses this URI, failing to canonicalize the path against the allow list before resolving it. This allows the malicious path to escape the intended restricted directory root. The server then processes the resolved path, granting read or write access to arbitrary files on the server’s filesystem that are outside the configured safe directory list, solely based on the client’s connection permissions.
Platform: Apache Kyuubi
Version: 1.6.0-1.10.2
Vulnerability : Path Traversal Bypass
Severity: High
date: Jan 5 2026
Prediction: Patched Jan 5 2026
What Undercode Say:
`$ curl -X POST ‘http://kyuubi-server:port/endpoint’ -d ‘file=../../../etc/shadow’`
`!/bin/bash`
` Attempts path traversal via session var`
`KYUUBI_URL=”http://target:10009″`
`PAYLOAD=”../../../../tmp/evil”`
` Crafted request using engine protocol`
`echo -e “open\t${PAYLOAD}” | nc target 10009`
How Exploit:
Craft URI containing `../` sequences.
Bypass `allow.list` config check.
Access arbitrary server files.
Read sensitive system data.
Write to unauthorized locations.
Protection from this CVE
Upgrade to v1.10.3.
Strict path canonicalization.
Enforce allow list validation.
Network isolation for servers.
Impact:
Unauthorized file read.
Potential data leakage.
System file compromise.
Loss of confidentiality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
