CVE-2026-44615

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	>= 0.9.0, < 0.12.1

References

https://github.com/apache/zeppelin/pull/5227Issue Tracking, Patch
https://github.com/apache/zeppelin/pull/5248Issue Tracking, Patch
https://lists.apache.org/thread/ps1f0symnyxzq8c2dc3244v051jcwp40Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/30/2Mailing List, Third Party Advisory

Timeline

Published: Jul 31, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-446166.5LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled CVE-2026-446176.5LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search fi CVE-2026-446185.3Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to up CVE-2026-44628.8Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a CVE-2026-446215.9With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', co CVE-2026-446226.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-446245.7Incorrect comparison in the Ext2 parser for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System CVE-2026-446256.8Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary CVE-2026-446275.8Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before version v2026.0.0 within R CVE-2026-446287.5An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage CVE-2026-446297.9Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E CVE-2026-44638.8Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via