CVE-2026-52680: Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

<p>Posted by Akira Ajisaka on Jul 30</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Kyuubi (org.apache.kyuubi:kyuubi-common) 1.7.0 through 1.11.1<br /> <br /> Description:<br /> <br /> Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a <br /> temporary uploaded resource. A remote attacker who can access the R