What is CVE-2026-52680?
This vulnerability exists in Apache Kyuubi's REST batch multipart upload handling, where the server uses the client-supplied filename for temporary resources. A remote attacker with access to the REST batch upload endpoint can exploit path traversal sequences in the filename to write files outside the intended directory, potentially leading to unauthorized file writes. Restrict access to the affected endpoint to mitigate the risk.
Related CVEs
link basis: same weakness class CWE-22; shared vendor: Apache
FAQ2
How can CVE-2026-52680 in Apache Kyuubi be exploited?
An attacker can exploit the REST batch multipart upload function by providing a path traversal sequence in the filename, causing temporary resources to be written to arbitrary locations.
What is recommended to mitigate CVE-2026-52680?
Restrict access to the REST batch upload endpoint to mitigate the risk.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.