CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Medium 6.5 Published 31 Jul 2026 Updated 31 Jul 2026

Authenticated attackers can move, write, or delete files outside the notebook directory via path traversal in Apache Zeppelin when FileSystemNotebookRepo is configured.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-44615?

CVE-2026-44615 is a medium-severity path traversal vulnerability in Apache Zeppelin, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Weakness: CWE-22

Which versions are affected by CVE-2026-44615?

It affects 1 product.

Products include Apache Zeppelin.

How do I fix CVE-2026-44615?

No fix has been published for CVE-2026-44615 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-44615 being exploited?

There is no known exploitation of CVE-2026-44615 in the wild and no public exploit code.

Sources

Also known as GHSA-5j5v-r5qf-p5c4.