The issue arises from a path‑traversal vulnerability in Apache Impala 4.5.2: the 'trusted_jar_paths' startup flag accepts relative paths that can resolve to a JAR located elsewhere on the file system. The same prefix that matches a configured trusted URI allows Impala to load that JAR during statement execution. Once the JAR is loaded, the code inside runs with the privileges of the Impala service, giving the attacker the ability to execute arbitrary code on the host machine. The flaw is a classic CWE‑23 style traversal and is only exploitable when the administrator has configured a non‑empty trusted_jar_paths value.

Only Apache Software Foundation’s Apache Impala version 4.5.2 is affected; the vulnerability requires that the 'trusted_jar_paths' option be set to a non‑empty list of URIs. The flaw does not exist in earlier or later releases, such as 4.5.3, which contains a fix that removes the path traversal logic.

The CVSS score of 6.5 suggests medium‑high severity, and the EPSS score of <1% indicates a low but not zero likelihood of exploitation in the wild. The flaw is not listed in CISA's KEV catalog. Exploitation requires an attacker who can create or alter DDL statements (CREATE DATA SOURCE, CREATE TABLE) that place a malicious JAR at a path that matches one of the trusted URIs. Once the JAR is loaded, remote code execution is possible under the account running the Impala service. Because the flaw relies on configuration and requires privilege to write DDL, the risk is moderate‑high for vulnerable deployments.