EUVD-2026-42833
GHSA-h3q7-wmrf-p69f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network path-traversal write (AV:N/AC:L/PR:N/UI:N); primary impact is integrity (I:H) with availability risk (A:H) from overwriting data/config, no direct read so C:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 2
AnalysisAI
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB process can write by abusing an unsafe API that fails to sanitize user-supplied pathnames. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality and integrity impact, and controlled file placement can escalate to code execution or overwrite of critical files. No public exploit has been identified at time of analysis, and EPSS is low (0.16%, 5th percentile) despite the 9.1 severity.
Technical ContextAI
Apache IoTDB is an open-source time-series database management system used to store and query telemetry from IoT, industrial (IIoT), and sensor deployments. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'): an exposed API accepts a filename/path parameter and builds a filesystem path without normalizing or constraining it to an intended directory, so traversal sequences (e.g. '../') or absolute paths let an attacker escape the intended write location. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_iotdb, covering all 1.0.0-2.0.9 releases of the server. Because the write executes with the privileges of the IoTDB process, the blast radius is bounded by that process's filesystem permissions.
RemediationAI
Vendor-released patch: upgrade to Apache IoTDB 2.0.10, which fixes the path traversal, per the Apache advisory (https://lists.apache.org/thread/zw2vkbmy5xkf5y8g237v81hrs4c6b5lq). This is the primary and recommended action for all deployments running 1.0.0 through 2.0.9. If immediate upgrade is not possible, reduce exposure by restricting network access to the IoTDB service - bind it to trusted internal interfaces only and block external access to its client/RPC ports at the firewall - and enforce least-privilege on the OS account running the IoTDB process so a successful write cannot reach OS-critical or web-served directories (trade-off: tightening that account's write scope requires re-validating data and WAL directory permissions to avoid disrupting normal operation). These are compensating controls only; they do not remove the vulnerable API, so 2.0.10 should be applied as soon as feasible.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today