This vulnerability involves improper limitation of pathname to a restricted directory (CWE-22) in Apache Zeppelin's FileSystemNotebookRepo configuration. Authenticated attackers with certain permissions can exploit path traversal by supplying traversal segments in note or folder paths. Zeppelin composes these into filesystem paths without ensuring they remain under the configured notebook directory, enabling unauthorized file or directory operations outside the notebook root. Affected versions are 0.9.0 through 0.12.0. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The issue is resolved in version 0.12.1.

An authenticated attacker with permission to rename notes or access folder operations can move, write, or delete files or directories outside the intended notebook root directory. This could lead to unauthorized disclosure or exposure of sensitive files due to the high confidentiality impact. There is no reported impact on integrity or availability.

Users should upgrade Apache Zeppelin to version 0.12.1, which fixes this path traversal vulnerability. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's versioning recommendation.