A critical path traversal vulnerability in Apache Kyuubi allows remote unauthenticated attackers to achieve arbitrary file writes, potentially leading to remote code execution.

This vulnerability is a path traversal flaw (CWE-22) triggered by improper validation of client-supplied filenames during multipart uploads. An unauthenticated remote attacker can supply a malicious filename to the REST batch upload endpoint to write files to unauthorized locations on the server filesystem.

The ability to write arbitrary files to the server filesystem presents a severe risk to organizational security. Successful exploitation could allow an attacker to overwrite critical system configuration files, deploy web shells, or corrupt data, resulting in full system compromise and unauthorized access to sensitive information. With a CVSS score of 9.8, this vulnerability is classified as critical due to the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade Apache Kyuubi to version 1.12.0 or later to apply the official vendor patch.

Proactive Monitoring: Review web server and application logs for suspicious REST API requests containing path traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts in multipart upload requests.

Public Exploit Available: No (exploit_available: false)

Given the critical severity and the potential for total system compromise, organizations running affected versions of Apache Kyuubi must prioritize patching immediately. The ease of exploitation via the network vector necessitates that this update be treated as a high-priority task to prevent unauthorized file system access.