EUVD-2025-210349
GHSA-xrvj-h9w2-3q69
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference files outside the intended directory using crafted '../' sequences in a pathname, yielding high-impact disclosure and modification of files (C:H/I:H). With a CVSS 3.1 score of 9.1 and PR:N/UI:N, the flaw is exploitable over the network against affected instances with no credentials or user interaction. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Path traversal in Apache IoTDB (versions 1.0.0 before 1.3.6 and 2.0.0 before 2.0.6) lets remote attackers read and write files outside intended directories by supplying crafted pathnames, with a CVSS 9.1 reflecting high confidentiality and integrity impact. The flaw was reported by the Apache project itself and patched in 1.3.6 and 2.0.6; there is no public exploit identified at time of analysis and the CVSS vector indicates no authentication is required (PR:N).
Path traversal in Apache IoTDB allows attackers to read or write files outside the intended restricted directory on the server. Affected versions span the 1.x branch (1.0.0 through 1.3.5) and the 2.x branch (2.0.0 through 2.0.5). No CVSS score or vector was provided by NVD at time of analysis, and no public exploit code or CISA KEV entry has been identified, but the CWE-22 classification and network-accessible nature of the service make this a meaningful risk for deployments running unpatched versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Apache Iotdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable low-complexity path traversal with file read and write (C:H/I:H, A:N); PR:L assessed because IoTDB database access is typically gated by authentication, though NVD rates PR:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.
Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.
Articles & Coverage 2
Executive ViewAI
Apache IoTDB deployments running versions 1.0.0-1.3.5 or 2.0.0-2.0.5 are exposed to a critical remote file access vulnerability (CVE-2025-55017, CVSS 9.1) that requires no authentication to exploit. Attackers can read and modify sensitive configuration files, database contents, and application files, potentially compromising IoT operations and data integrity. This unauthenticated network-accessible vulnerability requires immediate action to patch affected systems.
Within 24 hours: inventory and isolate Apache IoTDB instances running affected versions (1.0.0-1.3.5 and 2.0.0-2.0.5) from untrusted networks; consult Apache IoTDB security advisory for patched version numbers. Within 7 days: deploy vendor-released patches to upgrade all affected instances to non-vulnerable versions. Within 30 days: conduct file integrity audits on systems that were running vulnerable versions, review access logs for exploitation attempts, and verify complete remediation across the entire IoTDB deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Exploit-DB