CVE-2026-45188

LowCVSS 2.4/10Last modified Oct 25, 2026

Description

Relative Path Traversal vulnerability in Apache Kvrocks.

This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0.

Users are recommended to upgrade to version 2.16.0, which fixes the issue.

Metrics

CVSS 4.0 2.4/10CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Clear

Weakness enumeration

CWE-23

Affected software

VendorProductVersions
Apache Software FoundationApache Kvrocks>= 1.0.0, <= 2.15.0

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-45193.3The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. NCVE-2026-451906.5Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. InCVE-2026-451916.5Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP CVE-2026-451926.5A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with ConnectCVE-2026-451957.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outsCVE-2026-451967.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access whichCVE-2026-451972.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data oCVE-2026-451987.8Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot CVE-2026-451997.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-452007.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when fCVE-2026-452017.8Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating phyCVE-2026-452025.5Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corru