CVE-2025-66518 Apache Kyuubi: Unauthorized directory access due to missing path normalization

What is CVE-2025-66518?

CVE-2025-66518 is a high-severity path traversal vulnerability in Apache Kyuubi, published on 5 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.

This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.

Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

Weakness: CWE-22, CWE-27

Which versions are affected by CVE-2025-66518?

2 open source packages ship an affected version, including org.apache.kyuubi:kyuubi-server_2.12. It affects 1 product.

Products include Apache Kyuubi.

How do I fix CVE-2025-66518?

Upgrade org.apache.kyuubi:kyuubi-server_2.12 to 1.10.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-66518 being exploited?

There is no known exploitation of CVE-2025-66518 in the wild and no public exploit code.

Other vulnerabilities in Apache Kyuubi

• CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write Critical 9.8
• CVE-2026-62391 Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases High 8.1
• CVE-2026-23904 Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f8r6-6222-9pvc.