What is the CVSS score of EUVD-2025-210349?

EUVD-2025-210349 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache Iotdb are affected by EUVD-2025-210349?

Apache IoTDB deployments running versions 1.0.0-1.3.5 or 2.0.0-2.0.5 are exposed to a critical remote file access vulnerability (CVE-2025-55017, CVSS 9.1) that requires no authentication to exploit.. A patch is available.

How to fix or mitigate EUVD-2025-210349?

Within 24 hours: inventory and isolate Apache IoTDB instances running affected versions (1.0.0-1.3.5 and 2.0.0-2.0.5) from untrusted networks; consult Apache IoTDB security advisory for patched version numbers. Within 7 days: deploy vendor-released patches to upgrade all affected instances to non-vulnerable versions. Within 30 days: conduct file integrity audits on systems that were running vulnerable versions, review access logs for exploitation attempts, and verify complete remediation across the entire IoTDB deployment.

Apache Iotdb EUVD-2025-210349

| CVE-2025-55017 CRITICAL

Path Traversal (CWE-22)

2026-06-26 apache

GHSA-xrvj-h9w2-3q69

Apache Path Traversal Apache Iotdb

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable low-complexity path traversal with file read and write (C:H/I:H, A:N); PR:L assessed because IoTDB database access is typically gated by authentication, though NVD rates PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 19:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 19:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 19:22 NVD

9.1 (CRITICAL)

Patch available

Jun 26, 2026 - 14:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:22 vuln.today

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.

Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

Articles & Coverage 2

News 4 New Apache Vulnerabilities - 2 Critical, 2 High Severity Jun 27, 2026 News Critical Path Traversal in Apache IoTDB - CVE-2025-55017 Jun 26, 2026

AnalysisAI

Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference files outside the intended directory using crafted '../' sequences in a pathname, yielding high-impact disclosure and modification of files (C:H/I:H). With a CVSS 3.1 score of 9.1 and PR:N/UI:N, the flaw is exploitable over the network against affected instances with no credentials or user interaction. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.