Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-55017 EUVD-2025-210349GHSA-xrvj-h9w2-3q69

Apache IoTDB: Path Traversal Vulnerability

Published Jun 26, 2026 · Updated Jun 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: org.apache.iotdb:iotdb-server Ecosystem: Maven

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.

Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 2.0.0 – < 2.0.6, 1.0.0 – < 1.3.6 2.0.6

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:iotdb-server >= 2.0.0, < 2.0.6 2.0.6 GHSA-xrvj-h9w2-3q69
Maven org.apache.iotdb:iotdb-server >= 1.0.0, < 1.3.6 1.3.6 GHSA-xrvj-h9w2-3q69

References