CVE-2026-45188 is a Relative Path Traversal vulnerability affecting Apache Kvrocks from versions 1.0.0 up to and including 2.15.0. This vulnerability allows an attacker with high privileges and user interaction to influence file path resolution, potentially accessing unintended files relative to a base directory. The issue is resolved in version 2.16.0. The CVSS 4.0 vector indicates local attack vector, high attack complexity, required privileges at high level, and user interaction needed, with low confidentiality, integrity, and availability impacts.

The vulnerability could allow a privileged user to perform relative path traversal, potentially accessing or manipulating files outside intended directories. However, the low CVSS score and required high privileges and user interaction limit the risk and impact. There are no known exploits in the wild.

Users should upgrade Apache Kvrocks to version 2.16.0 or later, where this vulnerability is fixed. No other specific mitigations are indicated.