https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:03:40.545459+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-66518 CVE-2025-66518 — Apache Kyuubi: Unauthorized directory access due to missing path normalization 2026-10-07T16:03:40.561432+00:00

Affected: Apache Software Foundation Apache Kyuubi

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config.

This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2.

Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.