CVE-2026-41041
Received Received - Intake

URL Path Injection in Apache Gravitino

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Apache Software Foundation

Description
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-41041
EUVD
EUVD-2026-43324

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache gravitino From 1.0.0 (inc) to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-177 The product does not properly handle when all or part of an input has been URL encoded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a URL path injection issue in Apache Gravitino. It occurs because user-supplied identifiers are not properly encoded before being used in URL paths, which can allow an attacker to manipulate the URL path in unintended ways.

Impact Analysis

The vulnerability can allow attackers to inject malicious input into URL paths, potentially leading to unauthorized access, information disclosure, or other security issues depending on how the application processes these paths.

Mitigation Strategies

Users are recommended to upgrade Apache Gravitino to version 1.2.1, which fixes the URL path injection vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart