Apache Kyuubi's REST batch multipart upload feature improperly limits pathname usage by accepting client-supplied filenames without sanitization. This allows a remote attacker with access to the REST batch upload endpoint to include path traversal sequences in the filename, causing the server process to write files outside the designated upload directory, constrained only by filesystem permissions. The vulnerability affects versions from 1.7.0 through 1.11.1 and is resolved in version 1.12.0.

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to locations outside the intended upload directory on the server. This can lead to full confidentiality, integrity, and availability compromise of the affected system, as indicated by the CVSS score of 9.8 (critical).

Users should upgrade Apache Kyuubi to version 1.12.0 or later, where this path traversal vulnerability is fixed. No other mitigations or temporary workarounds are indicated in the provided data.