Apache IoTDB: Path Traversal Vulnerability
Priority MEDIUM 48CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00537 45th percentileScored 2026-11-07
Fix Fixed Apache IoTDB (Apache Software Foundation): 1.3.6, 2.0.7org.apache.iotdb:iotdb-server (Maven): 1.3.6, 2.0.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache IoTDB | 1.0.0 to before 1.3.6; 2.0.0 to before 2.0.7 | 1.3.6, 2.0.7 | Patch available | CNA |
| — | org.apache.iotdb:iotdb-server (Maven) | 1.0.0 to before 1.3.6 | 1.3.6 | Patch available | GHSA-h548-jhj8-q85h |
| — | org.apache.iotdb:iotdb-server (Maven) | 2.0.0 to before 2.0.7 | 2.0.7 | Patch available | GHSA-h548-jhj8-q85h |
- Apache IoTDB VendorApache Affected 1.0.0 to before 1.3.6; 2.0.0 to before 2.0.7 Fixed in 1.3.6, 2.0.7 Patch available CNA
- org.apache.iotdb:iotdb-server (Maven) Vendor— Affected 1.0.0 to before 1.3.6 Fixed in 1.3.6 Patch available GHSA-h548-jhj8-q85h
- org.apache.iotdb:iotdb-server (Maven) Vendor— Affected 2.0.0 to before 2.0.7 Fixed in 2.0.7 Patch available GHSA-h548-jhj8-q85h
Remediation
- Fix · CNA Apache IoTDB (Apache Software Foundation) Fixed in 1.3.6, 2.0.7
- Fix · GHSA-h548-jhj8-q85h org.apache.iotdb:iotdb-server (Maven) Fixed in 1.3.6 Advisory →
- Fix · GHSA-h548-jhj8-q85h org.apache.iotdb:iotdb-server (Maven) Fixed in 2.0.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64152
- 2026-10-03 Alias added: GHSA-h548-jhj8-q85h
- 2026-11-03 Fix available: Maven/org.apache.iotdb:[email protected], Maven/org.apache.iotdb:[email protected] · GHSA-h548-jhj8-q85h
- 2026-11-03 CVSS score added · GHSA-h548-jhj8-q85h
- 2026-11-03 Weakness changed · GHSA-h548-jhj8-q85h
- 2026-11-03 9 new references · GHSA-h548-jhj8-q85h
References
Advisory 2
Other 7
- https://github.com/apache/iotdb/pull/16596
- https://github.com/apache/iotdb/commit/3fdfe2e6ca99e3b65b3455c5aeb45cdb2302efab
- https://github.com/apache/iotdb/commit/7770bacf3d8a04bd4d4dea4d82694c137f48746e
- https://github.com/apache/iotdb
- https://github.com/apache/iotdb/releases/tag/v1.3.6
- https://github.com/apache/iotdb/releases/tag/v2.0.7
- http://www.openwall.com/lists/oss-security/2026/03/09/3
More Apache vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
- TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-64152 · CVE Program
- CVE-2025-64152 · NVD
- FIRST EPSS
- GHSA-h548-jhj8-q85h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences