Approved changes feed: RSS · Atom
cpe:2.3:a:aiven:karapace:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Aiven (55dae46f-23ce-5560-8065-cd68a0390f60) |
|---|---|
| Product | Karapace (95401326-650e-5cf5-853c-ad97922a1cb8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-29190 |
vulnerable | 2026-06-08 07:55:16.209162 |
Karapace: Path Traversal in Backup Reader
MEDIUM (4.1)
Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where Karapace is running. The issue affects deployments that use the backup/restore functionality and process backups from untrusted sources. The impact depends on the file system permissions of the Karapace process. This issue has been patched in version 6.0.0.
Published: 2026-03-07T15:16:15.148Z
Updated: 2026-03-09T18:27:12.083Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.