Skip to content
OpenAdvisories
High · 8.5 CVE-2025-48977 EUVD-2025-209980GHSA-v45h-mqf4-6939

Apache Ignite: REST HTTP arbitrary file read vulnerability

Published May 28, 2026 · Updated May 28, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Ignite Package: org.apache.ignite:ignite-core Package: trino Package: trino-plugin-bigquery Package: trino-plugin-ignite Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-teradata-functions Ecosystem: Maven Ecosystem: Wolfi

Description

Relative Path Traversal vulnerability in Apache Ignite REST API.

Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way.
This issue affects Apache Ignite: from 2.0.0 through 2.17.0.

Users are recommended to upgrade to version 2.18.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Ignite 2.0.0 – ≤ 2.17.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling trino +4 483-r7 —
Wolfi rolling trino-plugin-ignite 482-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.ignite:ignite-core >= 2.0.0, < 2.18.0 2.18.0 GHSA-v45h-mqf4-6939

References