CVE-2024-31860

Apache Zeppelin is vulnerable to a Path Traversal vulnerability (CWE-22) in versions 0.9.0 before 0.11.0 . The root cause is improper sanitization of user-supplied input, specifically the failure to properly handle relative path indicators such as ... An attacker can exploit this flaw to view the...

CVE-2024-31865

Apache Zeppelin (versions 0.8.2 before 0.11.1 ) is vulnerable to an Improper Input Validation flaw. An attacker can call the updating cron API using invalid or improper privileges, which allows a notebook to run with the elevated privileges of the user associated with the cron job. This could lea...

CVE-2018-1328

CVE-2018-1328 affects Apache Zeppelin prior to 0.8.0, where a stored XSS flaw exists via Note permissions. The root cause is unsanitized input in Note handling that can trigger script execution. Impact is user-facing XSS; remediation is upgrading Zeppelin to 0.8.0 or later (or applying equivalent...

CVE-2021-27578

CVE-2021-27578 is a Cross Site Scripting vulnerability in the Markdown interpreter of Apache Zeppelin. Affected product: Apache Zeppelin (web-based notebook). Affected version: prior to 0.9.0. Root cause: XSS in the markdown interpreter that allows an attacker to inject malicious scripts. Impact:...

CVE-2024-31867

Apache Zeppelin is vulnerable to an Improper Input Validation vulnerability (specifically LDAP filter injection ) due to insufficient sanitization of LDAP search property configurations. Attackers can exploit this by setting improper configuration properties to execute malicious queries against t...

CVE-2024-31868

Apache Zeppelin is vulnerable to a Cross-Site Scripting (XSS) flaw in its helium module due to improper encoding or escaping of output. An attacker can exploit this by modifying helium.json to inject malicious scripts, which are then exposed to normal users. This vulnerability affects versions fr...

CVE-2021-28655

CVE-2021-28655 (Apache Zeppelin) describes an improper input validation in the Move folder to Trash feature, enabling an attacker to delete arbitrary files. Affected product: Apache Zeppelin, version 0.9.0 and prior. Root cause: input validation flaw in the Move folder to Trash flow (NotebookServ...

CVE-2026-44613

Apache Zeppelin (versions 0.6.0 through 0.12.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause lies in a default CORS configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. Specifically, the CorsFilter, CorsUtils, and RES...

CVE-2026-44615

A path traversal vulnerability exists in Apache Zeppelin versions 0.9.0 through 0.12.0 . When FileSystemNotebookRepo is configured, an authenticated attacker with permissions to rename a note or perform folder operations can supply traversal segments (such as .. or URL-encoded %2e%2e) in note or ...

CVE-2026-44617

Apache Zeppelin versions 0.11.1 , 0.11.2 , and 0.12.0 are vulnerable to an LDAP filter injection vulnerability within the LdapRealm component. The root cause is that the software used RFC 4514 distinguished-name escaping instead of the required RFC 4515 filter escaping when constructing search fi...

CVE-2024-41177

Apache Zeppelin (specifically the zeppelin-web component) is vulnerable to Cross-Site Scripting (XSS) due to an incomplete blacklist of user input. The vulnerability exists within the Helium module , where insufficient input validation allows an attacker to inject and execute malicious scripts in...

CVE-2026-44616

An LDAP injection vulnerability exists in Apache Zeppelin versions 0.6.0 through 0.12.0. The ActiveDirectoryGroupRealm component constructs LDAP search filters without properly escaping user-controlled input. This allows an authenticated attacker to inject LDAP filter syntax via the user-search e...