{"id":"CVE-2026-90466","summary":"Apache Impala: Path traversal executes JARs outside trusted paths","details":"Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.\n\n\n\n\nThe startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.\n\n\n\n\nUsers are recommended to upgrade to version 4.5.3, which fixes this issue.","modified":"2026-10-15T02:47:47.908891676Z","published":"2026-10-07T08:47:12.542Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-23"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90466.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.5.2"},{"fixed":"4.5.3"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/07/20"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90466.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/m7qbho4j1g4v7kx7pbk4z2n8p9nx6bqn"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90466"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/impala","events":[{"introduced":"078470bb0471336fa7715cf9b72a5d713fd2751d"},{"last_affected":"078470bb0471336fa7715cf9b72a5d713fd2751d"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:apache:impala:4.5.2:-:*:*:*:*:*:*","extracted_events":[{"introduced":"4.5.2-NA"},{"last_affected":"4.5.2-NA"}]}}],"versions":["4.5.2-NA","4.5.2-rc2","4.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90466.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}