← Advisories

Apache Ambari 3.0.0 (MpackManager) Path Traversal Arbitrary File Write

High

Advisory ID

ZSL-2026-6038

Release Date

30 October 2026

Vendor

The Apache Software Foundation - https://www.apache.org

Affected Version

3.0.0

CVE

N/A

Tested On

GNU/Linux x86_64 (7.0.12), JDK 17, PostgreSQL 10.23

Summary

The Apache Ambari project is aimed at making Hadoop management simpler by developing software for provisioning, managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive, easy-to-use Hadoop management web UI backed by its RESTful APIs.

Description

Apache Ambari is vulnerable to path traversal (Zip-Slip) in its management-pack extraction: a POST /api/v1/mpacks install downloads an attacker-supplied tar.gz and MpackManager.extractTar writes each entry using its name verbatim (new File(untarDirectory, entry.getName())) with no ../canonical-path check. A crafted entry such as ../../../../../../etc/cron.d/ambari_pwn is written outside the staging directory on the ambari-server host as the ambari-server user resulting in arbitrary file write and remote code execution on the management server (the archive URL is also fetched via new URL(mpackUri).openStream(), a secondary SSRF primitive). The operation requires the top-level AMBARI_ADMINISTRATOR role, so this is an application-admin to OS-level-RCE escalation that a well-formed mpack cannot achieve.

MpackManager.extractTar - mpack/MpackManager.java:250-283:
----------------------------------------------------------

private void extractTar(Path tarPath, File untarDirectory) throws IOException {
    TarArchiveInputStream tarFile = new TarArchiveInputStream(
        new GzipCompressorInputStream(new BufferedInputStream(new FileInputStream(new File(String.valueOf(tarPath))))));
    TarArchiveEntry entry;
    while ((entry = tarFile.getNextTarEntry()) != null) {
        File outputFile = new File(untarDirectory, entry.getName());
        if (entry.isDirectory()) {
            outputFile.mkdirs();
        } else {
            outputFile.getParentFile().mkdirs();
            final OutputStream outputFileStream = new FileOutputStream(outputFile);
            IOUtils.copy(tarFile, outputFileStream);
        }
    }
}

Proof of Concept

ambari.pyTXT

Disclosure Timeline

13.09.2026Vulnerability discovered.

13.09.2026Contact with the vendor.

14.09.2026Vendor forwards details to appropriate PMC.

29.10.2026No response from the vendor.

30.10.2026Public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]https://ambari.apache.org

[2]https://github.com/apache/ambari

Changelog

30.10.2026Initial release