The vulnerability occurs during the deletion of metadata backups in Apache Kylin. A path‑confinement bypass allows an attacker to delete files outside the intended backup directory, which can result in loss of critical metadata or make the Kylin service unavailable. The weakness is a form of path traversal that undermines file‑system isolation.

Apache Kylin releases from 4.0.0 through 5.0.4 are affected. Version 5.0.5 contains a fix for the issue.

The vulnerability lacks a publicly disclosed CVSS score and EPSS data, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, through the Kylin service exposed to the public network; deployments that are not publicly exposed are not commonly impacted. An attacker who can reach the deletion endpoint can exploit the path‑confinement bypass to remove arbitrary files, potentially causing data loss or service disruption.