CVE-2026-41041

Description

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

PUBLISHED Reserved 2026-04-16 | Published 2026-07-13 | Updated 2026-07-13 | Assigner apache

Problem types

CWE-177 Improper Handling of URL Encoding (Hex Encoding)

Product status

Credits

Andrea Cosentino (ancosen@gmail.com) reporter

References

www.openwall.com/lists/oss-security/2026/07/13/1

lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz vendor-advisory

cve.org (CVE-2026-41041)

nvd.nist.gov (CVE-2026-41041)

Download JSON