CVE-2026-41041

CriticalCVSS 9.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.

Risk Assessment

An attacker could manipulate URL paths, potentially gaining access to unauthorized resources or performing unintended operations on the server.

Recommendation

Upgrade Apache Gravitino to version 1.2.1 immediately, which includes a fix for this vulnerability.

Original NVD description (English source)

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.