CVE-2026-44615: Path traversal in NotebookRepo note and folder path composition
Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44615?
CVE-2026-44615 has a medium severity rating of 6.5 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-44615?
To mitigate CVE-2026-44615, ensure that only trusted authenticated users have permission to rename notes or access folder operations in Apache Zeppelin.
What type of vulnerability is CVE-2026-44615?
CVE-2026-44615 is a path traversal vulnerability that affects Apache Zeppelin's FileSystemNotebookRepo configuration.
What could an attacker achieve by exploiting CVE-2026-44615?
An authenticated attacker could exploit CVE-2026-44615 to manipulate filesystem paths, potentially exposing sensitive files.
In which software is CVE-2026-44615 found?
CVE-2026-44615 is found in Apache Zeppelin, specifically when using the FileSystemNotebookRepo feature.