CVE-2026-44615

{"id": "CVE-2026-44615", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44615", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T16:20:09.545748Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Zeppelin", "versions": [{"status": "affected", "version": "0.9.0", "lessThan": "0.12.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T11:17:10.087", "references": [{"url": "https://github.com/apache/zeppelin/pull/5227", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://github.com/apache/zeppelin/pull/5248", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/ps1f0symnyxzq8c2dc3244v051jcwp40", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/30/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue."}, {"lang": "es", "value": "Vulnerabilidad de salto de ruta en Apache Zeppelin. Cuando FileSystemNotebookRepo est\u00e1 configurado, un atacante autenticado con permiso para renombrar una nota, o acceso a operaciones de carpeta, podr\u00eda proporcionar segmentos de salto en rutas de notas o carpetas. Zeppelin compuso estos valores en rutas del sistema de archivos utilizando el sistema de archivos del servidor o la identidad de Hadoop sin asegurar que el resultado permaneciera bajo el directorio de notebooks configurado. Esto podr\u00eda permitir que archivos o directorios de notebooks fueran movidos, escritos o eliminados fuera de la ra\u00edz del notebook. Este problema afecta a las versiones de Apache Zeppelin 0.9.0 a 0.12.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 0.12.1, que corrige este problema."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C3D3BB7-49F2-4413-BA14-5A444950623B", "versionEndExcluding": "0.12.1", "versionStartIncluding": "0.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}