CVE-2026-45188— Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling
Possible ATT&CK Techniques 1AI
T1564.004 · NTFS File AttributesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Kvrocks | 1.0.0≤ 2.15.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45188
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling
Source: CVE Program / CVE List V5
Vulnerability Description
Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/RE:L/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
相对路径遍历
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Kvrocks 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache kvrocks是美国Apache基金会开源的一款兼容Redis协议的键值数据库。 Apache Kvrocks 1.0.0版本至2.15.0版本存在路径遍历漏洞，该漏洞源于容易受到相对路径遍历攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Kvrocks | 1.0.0 ~ 2.15.0 | - |
II. Public POCs for CVE-2026-45188
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45188
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-45188 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-25 · 7 CVEs total
| CVE-2026-54226 | Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS | |
| CVE-2026-46752 | Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() | |
| CVE-2026-46751 | Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allow | |
| CVE-2026-41566 | Apache Kvrocks: Improper permission for the APPLYBATCH command | |
| CVE-2026-56130 | Apache Shiro: Remember-me cookie isn't checked for expiry on the server | |
| CVE-2026-56091 | Apache Shiro: Authentication bypass in Guice-Web integration |
IV. Related Vulnerabilities
Same product: Apache Kvrocks
- CVE-2026-41566
Apache Kvrocks: Improper permission for the APPLYBATCH comma - CVE-2026-46751
Apache Kvrocks: Does not remove the unsafe loadstring functi - CVE-2026-46752
Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() - CVE-2026-54226
Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Rem - CVE-2025-59792
Apache Kvrocks: MONITOR command reveals plaintext credential
Same vendor: Apache Software Foundation
- CVE-2026-34884
Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and - CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v
Same weakness: CWE-23
- CVE-2026-72677
Relative Path Traversal in Kibana Fleet Leading to Unauthori - CVE-2026-16230
Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arb - CVE-2026-70337
Microsoft PowerShell Remote Code Execution Vulnerability - CVE-2026-65810
.NET Framework Elevation of Privilege Vulnerability - CVE-2026-62837
Microsoft SharePoint Server Information Disclosure Vulnerabi
V. Comments for CVE-2026-45188
No comments yet