Live › vulnerability › CVE-2025-55017
Apache IoTDB server mishandles file paths, so a crafted request can read or write files outside the intended directory. The advisory rates it critical (CVSS 9.1), and the sources do not say what a request needs to reach the flaw.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:57 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache IoTDB server versions 2.0.0 to before 2.0.6 or 1.0.0 to before 1.3.6. The sources do not say whether default configuration or authentication limits exposure, so unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.iotdb:iotdb-server | maven | >= 2.0.0, < 2.0.6 | 2.0.6 |
| org.apache.iotdb:iotdb-server | maven | >= 1.0.0, < 1.3.6 | 1.3.6 |
iotdb-server version in your Maven dependencies or deployment, and see whether it falls in >= 2.0.0, < 2.0.6 or >= 1.0.0, < 1.3.6.2.0.6 on the 2.0 line.1.3.6 on the 1.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.
Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2025-55017")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.