A critical path injection vulnerability in Apache Gravitino allows unauthenticated attackers to potentially access unauthorized resources.

The application incorrectly handles URL encoding, leading to an Improper Handling of URL Encoding (CWE-177) vulnerability that permits URL path injection by unauthenticated users.

A successful exploit could allow an attacker to bypass directory restrictions, potentially leading to unauthorized data access or exposure of sensitive backend system information. The CVSS score of 9.1 reflects the high severity of this vulnerability regarding potential system compromise.

Immediate Action: Upgrade to Apache Gravitino version 1.2.1 or later to resolve the improper encoding flaw.

Proactive Monitoring: Review web server access logs for requests containing unusual URL patterns or attempts to traverse paths using encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts and filter suspicious URL encoding patterns.

Public Exploit Available: Unknown.

Organizations utilizing Apache Gravitino should treat this as a high-priority update. Upgrading to version 1.2.1 is the only definitive way to mitigate the path injection risk and protect the integrity of the data managed by the platform.