Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-64152 EUVD-2025-210350GHSA-h548-jhj8-q85h

Apache IoTDB: Path Traversal Vulnerability

Published Jun 26, 2026 · Updated Jun 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: org.apache.iotdb:iotdb-server Ecosystem: Maven

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 1.0.0 – < 1.3.6, 2.0.0 – < 2.0.7 1.3.6

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:iotdb-server >= 1.0.0, < 1.3.6 1.3.6 GHSA-h548-jhj8-q85h
Maven org.apache.iotdb:iotdb-server >= 2.0.0, < 2.0.7 2.0.7 GHSA-h548-jhj8-q85h

References