Apache Gravitino is vulnerable to a path traversal flaw caused by unencoded user‑supplied identifiers that are embedded in a REST client URL using Python f‑strings. This flaw allows an attacker to craft a payload that causes the REST client to traverse the URL path to unintended API endpoints. The weakness is classified as CWE‑177, reflecting a classic path traversal vulnerability that can be abused to access resources outside the intended scope.

The issue affects Apache Gravitino versions from 1.0.0, maintained by the Apache Software Foundation. Any deployment using these affected releases is at risk if the MCP REST client is exposed to untrusted input.

The vulnerability carries a CVSS score of 9.1 and an EPSS score of less than 1%, meaning the probability of exploitation is considered low but non‑zero. It is not listed in the CISA KEV catalog. The likely attack vector is network‑based, inferred from the description, as an attacker can send a specially crafted identifier to the REST client and cause it to traverse the URL path to a protected endpoint. The high severity rating indicates that exploitation could have significant impact on systems that expose Gravitino services to external or partially trusted networks.