Path traversal in Apache Kylin - CVE-2026-108762
Published: October 22, 2026
Vulnerability identifier: #VU157256
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108762
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass path restrictions and potentially delete files outside the intended metadata backup location.
The vulnerability exists due to improper restriction of file paths in the Apache Kylin metadata backup deletion functionality when processing deletion requests. A remote user can supply a crafted path to potentially cause deletion outside the intended metadata backup location.
Affected software
Apache Kylin
How to mitigate CVE-2026-108762
Install security update from vendor's website.
Apache Kylin - update to 5.0.5