CVE-2026-52680

🗓️ 30 Jul 2026 16:07:12Reported by apacheType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

Kyuubi REST batch upload path traversal via filename writes outside the upload dir; affected versions 1.7.0–1.11.1; upgrade to 1.12.0.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2026-52680	4 Aug 202609:35	–	githubexploit
attackerkb	CVE-2026-52680	30 Jul 202616:07	–	attackerkb
Circl	CVE-2026-52680	30 Jul 202611:47	–	circl
Cvelist	CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write	30 Jul 202616:07	–	cvelist
EUVD	EUVD-2026-51185	30 Jul 202616:07	–	euvd
Kitploit	CVE-2026-52680_exploit	24 Sep 202616:01	–	kitploit
NVD	CVE-2026-52680	30 Jul 202616:17	–	nvd
Positive Technologies	PT-2026-66517	30 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-52680: Improper Limitation of a Pathname to a Restricted Directory	30 Jul 202600:00	–	rapid7
Snyk	Directory Traversal	30 Jul 202617:50	–	snyk

NVD

Vulners

Node

apache kyuubiRange1.7.0–1.12.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.kyuubi:kyuubi-common",
    "product": "Apache Kyuubi",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.11.1",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/b0qx2v8k5v4rrqsh53pb146t7so0lmrk
openwall	www.openwall.com/lists/oss-security/2026/07/30/5

Parameter	Position	Path	Description	CWE
resourceFile.filename	request body	/api/v1/batches	Unauthenticated path traversal in REST batch upload endpoint allowing client-supplied filename to write files outside the upload directory.	CWE-22, CWE-73

05 Aug 2026 17:22Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.0111

SSVC