Path traversal in Apache Storm
Priority LOW 29CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Why it matters now
EPSS 0.02247 82nd percentileScored 2026-11-07
Fix Fixed org.apache.storm:storm-core (Maven): 1.1.3, 1.2.2, 1.0.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Storm | Apache Storm 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier | — | No fix listed | CNA |
| — | org.apache.storm:storm-core (Maven) | 1.1.0 to before 1.1.3 | 1.1.3 | Patch available | GHSA-898j-5cc8-cmf5 |
| — | org.apache.storm:storm-core (Maven) | 1.2.0 to before 1.2.2 | 1.2.2 | Patch available | GHSA-898j-5cc8-cmf5 |
| — | org.apache.storm:storm-core (Maven) | before 1.0.7 | 1.0.7 | Patch available | GHSA-898j-5cc8-cmf5 |
- Apache Storm VendorApache Affected Apache Storm 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier Fixed in — No fix listed CNA
- org.apache.storm:storm-core (Maven) Vendor— Affected 1.1.0 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-898j-5cc8-cmf5
- org.apache.storm:storm-core (Maven) Vendor— Affected 1.2.0 to before 1.2.2 Fixed in 1.2.2 Patch available GHSA-898j-5cc8-cmf5
- org.apache.storm:storm-core (Maven) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-898j-5cc8-cmf5
Remediation
- Fix · GHSA-898j-5cc8-cmf5 org.apache.storm:storm-core (Maven) Fixed in 1.1.3 Advisory →
- Fix · GHSA-898j-5cc8-cmf5 org.apache.storm:storm-core (Maven) Fixed in 1.2.2 Advisory →
- Fix · GHSA-898j-5cc8-cmf5 org.apache.storm:storm-core (Maven) Fixed in 1.0.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8008
- 2026-10-03 Alias added: GHSA-898j-5cc8-cmf5
References
Advisory 2
Other 6
- https://lists.apache.org/thread.html/613b2fca8bcd0a3b12c0b763ea8f7cf62e422e9f79fce6cfa5b08a58%40%3Cdev.storm.apache.org%3E
- https://github.com/apache/storm/commit/0fc6b522487c061f89e8cdacf09f722d3f20589
- https://github.com/apache/storm/commit/efad4cca2d7d461f5f8c08a0d7b51fabeb82d0a
- https://github.com/apache/storm/commit/f61e5daf299d6c37c7ad65744d02556c94a16a4
- https://issues.apache.org/jira/browse/STORM-3052
- https://lists.apache.org/thread.html/613b2fca8bcd0a3b12c0b763ea8f7cf62e422e9f79fce6cfa5b08a58@%3Cdev.storm.apache.org%3E
More Apache Storm vulnerabilities
- TI-2021-15907 Shell Command Injection Vulnerability in Nimbus Thrift Server CVSS 3.1CRITICAL 9.8
- TI-2021-17787 Unsafe Pre-Authentication Deserialization In Workers CVSS 3.1CRITICAL 9.8
- TI-2015-02819 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to… CVSS 3.0CRITICAL 9.8
- TI-2018-08436 Deserialization of untrusted data in Apache Storm CVSS 3.0CRITICAL 9.8
- TI-2017-07179 It was found that under some situations and configurations of Apache Storm 1.x before… CVSS 3.0HIGH 8.8
- TI-2018-01232 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and… CVSS 3.0HIGH 8.8
Sources
- CVE-2018-8008 · CVE Program
- CVE-2018-8008 · NVD
- FIRST EPSS
- GHSA-898j-5cc8-cmf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences