Apache Kyuubi's REST batch multipart upload functionality improperly limits pathnames when handling client-supplied filenames. Specifically, the server uses the multipart filename directly when creating temporary upload files, enabling path traversal via crafted filenames. This vulnerability affects versions from 1.7.0 through 1.11.1. An attacker able to access the REST batch upload endpoint can exploit this to write arbitrary files outside the designated upload directory, subject to filesystem permissions. The vulnerability is resolved in version 1.12.0.

An attacker with access to the REST batch upload endpoint can cause the Kyuubi server process to write files to arbitrary locations on the filesystem outside the intended upload directory. The impact depends on the filesystem permissions of the Kyuubi server process. This could lead to unauthorized file creation or modification, potentially affecting system integrity or enabling further attacks.

Users should upgrade Apache Kyuubi to version 1.12.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is provided in the available information.