Threats tagged 'ghsa-h9qj-gx4p-69cp'

Apache Kyuubi versions 1.7.0 through 1.11.1 contain a path traversal vulnerability in the REST batch multipart upload handling. The server uses the client-supplied multipart filename when creating temporary uploaded resources, allowing a remote attacker to write files outside the intended directory if they can access the upload endpoint. This issue is fixed in version 1.12.0.