Loading story…
A high-severity vulnerability, tracked as CVE-2025-66518, was discovered in Apache Kyuubi, allowing unauthorized directory access due to missing path normalization. This flaw enables any client with access to the Kyuubi server via frontend protocols to bypass the kyuubi.session.local.dir.allow.list configuration and access local files not explicitly permitted by the server's configuration. The vulnerability affects Apache Kyuubi versions from 1.6.0 through 1.10.2, and it is remotely exploitable, posing a significant risk to affected deployments.
The Apache security team recommends upgrading to version 1.10.3 or later to remediate the issue. No affected products are explicitly listed beyond the core Kyuubi server, but the vulnerability's nature means any deployment using the impacted versions is at risk. Organizations using Apache Kyuubi should prioritize patching to prevent unauthorized file access and potential data exposure.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-66518 was publicly disclosed as a high-severity vulnerability (CVSS 8.8) in Apache Kyuubi. Apache confirmed the issue, warning that attackers with access via frontend protocols could bypass kyuubi.session.local.dir.allow.list and access unauthorized local server files.
Apache addressed CVE-2025-66518, a path traversal issue caused by missing path normalization in Apache Kyuubi, by releasing version 1.10.3. The flaw affects Kyuubi versions 1.6.0 through 1.10.2 and allows unauthorized access to local files outside the configured allow list.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-62390**, an important-severity SQL injection vulnerability in Apache Kylin affecting versions **4 through 5.0.3**. The flaw is in a backend API used to refresh the table catalog cache, where improper neutralization of special elements can allow SQL injection in generated SQL statements. Apache said the issue is fixed in **Apache Kylin 5.0.4** and urged users to upgrade to that release. The vulnerability is tracked internally as **`KYLIN-6089`**, and credit for the discovery was given to **罗鑫**.
Jul 15, 2026
Apache Tomcat JK Web Server Connector (`mod_jk`) versions 1.2.x before 1.2.23 contain a directory-traversal and authorization-bypass flaw tracked as **CVE-2007-1860**. The issue arises because Apache HTTP Server decodes a request URL before passing it to Tomcat, allowing the two components to interpret the path differently. A remote attacker could craft requests using a `JkMount` prefix, including double-encoded `..` path sequences, to bypass access controls and reach protected pages. Organizations using affected `mod_jk` deployments should upgrade to version 1.2.23 or later and review exposed mounted paths and authorization rules for potential unauthorized access.
Aug 29, 2026
A critical XML External Entity (XXE) injection vulnerability, tracked as CVE-2025-68493, has been identified in the XWork component of Apache Struts 2. This flaw allows attackers to exploit improper XML input validation, potentially leading to sensitive data disclosure, server-side request forgery (SSRF), and denial-of-service (DoS) attacks. The vulnerability affects a wide range of Struts 2 versions, including 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.1.0, exposing millions of applications to risk. Security researchers at ZAST.AI reported the issue, and Apache has rated the vulnerability as 'Important' due to its significant impact on data confidentiality and system availability. Organizations using affected versions are strongly advised to upgrade to Struts 6.1.1, which addresses the vulnerability. The issue is remotely exploitable and has been assigned a CVSS 3.1 score of 8.1 (High). Immediate patching is recommended to prevent exploitation, as attackers can leverage this flaw to extract configuration files, database credentials, and other sensitive information from vulnerable servers. The vulnerability has been confirmed by both independent security researchers and the Apache security team.
Jun 29, 2026