https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:42:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-90466 <p>Path traversal of &#39;trusted_jar_paths&#39; in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in &#39;trusted_jar_paths&#39;.</p> <p>The startup flag &#39;trusted_jar_paths&#39; references URIs for loading files from local or remote filesystems. Path traversal can&#39;t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires &#39;trusted_jar_paths&#39; have a non-empty value configured by the Impala admin.</p> <p>Users are recommended to upgrade to version 4.5.3, which fixes this issue.</p> <p>Path traversal of &#39;trusted_jar_paths&#39; in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in &#39;trusted_jar_paths&#39;.</p> <p>The startup flag &#39;trusted_jar_paths&#39; references URIs for loading files from local or remote filesystems. Path traversal can&#39;t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires &#39;trusted_jar_paths&#39; have a non-empty value configured by the Impala admin.</p> <p>Users are recommended to upgrade to version 4.5.3, which fixes this issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-90466 https://vulnerability.circl.lu/vuln/ghsa-xf54-j4ff-f2xp <p>Path traversal of &#39;trusted_jar_paths&#39; in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in &#39;trusted_jar_paths&#39;.</p> <p>The startup flag &#39;trusted_jar_paths&#39; references URIs for loading files from local or remote filesystems. Path traversal can&#39;t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires &#39;trusted_jar_paths&#39; have a non-empty value configured by the Impala admin.</p> <p>Users are recommended to upgrade to version 4.5.3, which fixes this issue.</p> <p>Path traversal of &#39;trusted_jar_paths&#39; in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in &#39;trusted_jar_paths&#39;.</p> <p>The startup flag &#39;trusted_jar_paths&#39; references URIs for loading files from local or remote filesystems. Path traversal can&#39;t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires &#39;trusted_jar_paths&#39; have a non-empty value configured by the Impala admin.</p> <p>Users are recommended to upgrade to version 4.5.3, which fixes this issue.</p> https://vulnerability.circl.lu/vuln/ghsa-xf54-j4ff-f2xp