EUVD-2026-41854
GHSA-rpg4-r93p-w6gg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation requires the non-default condition of the internal DataNode RPC port being network-exposed; PR:N since no auth is needed once reachable; C/I/A:H as attacker-controlled file write is credibly escalatable to RCE.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can reach the internal DataNode RPC port to smuggle path-traversal sequences in an uploaded Trigger JAR filename, writing files outside the Trigger installation directory with the IoTDB process's privileges. Because the write is attacker-controlled, it can plausibly be escalated to remote code execution by overwriting configuration or startup artifacts. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 4th percentile), consistent with exploitation being gated on an exposed internal port rather than a default-reachable service.
Technical ContextAI
Apache IoTDB is an open-source time-series database purpose-built for IoT and industrial telemetry; it uses a distributed architecture in which ConfigNodes and DataNodes communicate over internal Thrift RPC interfaces. The affected code path is the DataNode internal RPC method that materializes user-defined Trigger plugins: the client-supplied Trigger JAR name is concatenated into a filesystem path used to persist the JAR into the Trigger installation directory without adequately sanitizing traversal metacharacters. NVD classifies the root cause as CWE-284 (Improper Access Control), reflecting that a privileged internal-only interface is being reached and trusted, though the concrete exploitation primitive is a classic path traversal (CWE-22) - the vendor tags corroborate both 'Path Traversal' and 'Authentication Bypass'. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_iotdb:*, i.e. the core IoTDB server product rather than a plugin or client library.
RemediationAI
Vendor-released patch: upgrade Apache IoTDB to version 2.0.8, which fixes the insufficient JAR-name validation, per the Apache advisory (https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m). If immediate upgrade is not possible, the most effective compensating control is to ensure the internal DataNode RPC port is not reachable from untrusted networks: bind it to internal interfaces only and restrict it with firewall/security-group rules or network segmentation so only trusted ConfigNodes/DataNodes can connect - this directly removes the stated exploitation precondition, with the trade-off that misconfigured segmentation could disrupt legitimate cluster inter-node communication, so validate cluster membership after locking down. Additionally restrict who can create Trigger instances and monitor the Trigger installation directory for unexpected file writes; these are detective/limiting measures rather than a fix and do not substitute for upgrading to 2.0.8.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today