CVE-2025-66518: High-Severity Flaw in Apache Kyuubi Exposes Local Server Files

CVE-2025-66518 is described as a high-severity flaw in Apache Kyuubi that could allow unauthorized access to a server’s local file system, with a CVSS score of 8.8. The vulnerability lies in how the Kyuubi Server handles file paths, where missing path normalization undermines the effectiveness of the directory allow-list. Administrators rely on kyuubi.session.local.dir.allow[.]list to restrict access to local directories, but this safety check can be bypassed by exploiting the flaw.

The issue affects Apache Kyuubi 1.6.0 through 1.10.2, and a fix has been released to enforce proper path normalization, with administrators urged to upgrade to version 1.10.3 or higher immediately. According to the disclosure, any client who can access the Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config and use local files not listed in the config.