CVE-2025-66518 json
Apache Kyuubi: Unauthorized directory access due to missing path normalization
published 10mo ago modified last mo. also EUVD-2026-0819 , GHSA-f8r6-6222-9pvc
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.
This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.
Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
Patch / fix
- maven org.apache.kyuubi:kyuubi-server_2.12 1.10.3
- org.apache.kyuubi kyuubi-server 1.10.3
Is CVE-2025-66518 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10mo ago
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.kyuubi:kyuubi-server_2.12 | >=1.6.0, <1.10.3 |
1.10.3 |
Affected products
- Apache Software Foundation Apache Kyuubi
Classification
References
-
lists.apache.org
/thread/xp460bwbyzdhho34ljd4nchyt2fmhodl
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/01/05/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-66518
advisory
-
github.com
/apache/kyuubi
package
Sources
- CVE List CVE-2025-66518
- GitHub Advisory GHSA-f8r6-6222-9pvc
- NVD CVE-2025-66518
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.