What is the CVSS score of EUVD-2025-210350?

EUVD-2025-210350 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Apache Iotdb are affected by EUVD-2025-210350?

Apache IoTDB versions 1.0.0-1.3.5 and 2.0.0-2.0.6 contain a critical path traversal vulnerability (CVSS 9.1) that permits remote attackers to read and write files on affected systems without…. A patch is available.

How to fix or mitigate EUVD-2025-210350?

Within 24 hours: Identify all systems running Apache IoTDB and document current version numbers. Within 7 days: Upgrade IoTDB 1.x installations to version 1.3.6 or later and IoTDB 2.x installations to version 2.0.7 or later using official vendor releases. Within 30 days: Verify successful deployment of patches across all systems, review access logs for suspicious file operations, and confirm system integrity.

Apache Iotdb EUVD-2025-210350

| CVE-2025-64152 CRITICAL

Path Traversal (CWE-22)

2026-06-26 apache

GHSA-h548-jhj8-q85h

Apache Path Traversal Apache Iotdb

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable path traversal with no auth or interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file read and write give C:H/I:H, with no direct availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 19:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 19:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 19:22 NVD

9.1 (CRITICAL)

Patch available

Jun 26, 2026 - 14:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:21 vuln.today

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

Articles & Coverage 2

News 4 New Apache Vulnerabilities - 2 Critical, 2 High Severity Jun 27, 2026 News Critical Path Traversal in Apache IoTDB 1.3.6/2.0.7 - CVE-2025-64152 Jun 26, 2026

AnalysisAI

Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write files outside the intended restricted directory by supplying crafted pathnames, leading to high confidentiality and integrity impact. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) indicating network-reachable, unauthenticated exploitation against affected versions. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; fixed versions 1.3.6 and 2.0.7 are available from the Apache vendor.