This vulnerability arises from Apache Kyuubi’s REST batch multipart upload handling, which uses the client‐supplied filename to create temporary uploaded resources. An attacker who can reach the REST batch upload endpoint can supply a filename containing path traversal sequences, causing the Kyuubi server process to write controlled content outside the intended upload directory. By writing arbitrary files as the Kyuubi process user, an attacker can potentially overwrite configuration files, substitute executable code, or otherwise manipulate the system, leading to loss of confidentiality, integrity or availability and possibly remote code execution.

Apache Kyuubi versions 1.7.0 through 1.11.1 are affected. The vendor is the Apache Software Foundation. The vulnerability exists in the REST batch upload component of these releases.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, but the CVSS score of 9.8 indicates a critical severity, placing it in a high‑risk category. An attacker with access to the REST endpoint can craft a path traversal payload in the filename field; the server will then create or overwrite files wherever the filesystem permissions allow. Since the attack vector is remote and the affected service is exposed, the likelihood and potential impact are high, particularly if the server process runs with elevated privileges.