During deletion of metadata backups, Apache Kylin fails to enforce file‑path confinement. This allows a user to specify a path that resolves outside the intended backup directory, causing deletion of arbitrary files. The result can be loss of vital metadata or rendering the Kylin service unavailable. The weakness is a path traversal flaw identified as CWE‑22.

Apache Kylin releases from version 4.0.0 through 5.0.4 are affected. The vendor recommends upgrading to 5.0.5 or later to mitigate the vulnerability.

The CVSS score of 7.3 indicates a high severity of the vulnerability. Its EPSS score is less than 1%, suggesting a very low probability of exploitation today, and it is not listed in the CISA KEV catalog. The likely attack vector is remote via the Kylin service exposed to the public network; this inference is based on the description that the vulnerability primarily impacts services directly reachable from the internet. An attacker who can reach the metadata‑deletion endpoint may exploit the path‑confinement bypass to delete arbitrary files, possibly causing data loss or service disruption.