{"id":"CVE-2025-55017","kind":"vulnerability","aliases":["CVE-2025-55017","GHSA-xrvj-h9w2-3q69"],"related":[],"title":"Apache IoTDB has a Path Traversal vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.\n\nUsers are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.","summary":"Apache IoTDB server mishandles file paths, so a crafted request can read or write files outside the intended directory. The advisory rates it critical (CVSS 9.1), and the sources do not say what a request needs to reach the flaw.","severity":"critical","cvss":9.1,"epss":0.00537,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.iotdb:iotdb-server","fixed":["2.0.6"],"affected":">= 2.0.0, < 2.0.6","ecosystem":"maven"},{"name":"org.apache.iotdb:iotdb-server","fixed":["1.3.6"],"affected":">= 1.0.0, < 1.3.6","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-iotdb","cwe-22","iotdb-server","java","maven","package","time-series-database"],"not_affected_if":["versions-outside-affected-ranges"],"how_to_check":"- Check the installed `iotdb-server` version in your Maven dependencies or deployment, and see whether it falls in `>= 2.0.0, < 2.0.6` or `>= 1.0.0, < 1.3.6`.","fix":"- Upgrade to `2.0.6` on the 2.0 line.\n- Upgrade to `1.3.6` on the 1.x line.","status":"open","published_at":"2026-06-26T13:16:33+00:00","first_seen_at":"2026-11-03T21:57:17+00:00","triaged_at":"2026-11-03T21:57:29+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:57:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.0.6` on the 2.0 line.\n- Upgrade to `1.3.6` on the 1.x line.","reach":"network","title":"Apache IoTDB: path traversal lets remote users reach files outside directories","impact":"high","summary":"Apache IoTDB server mishandles file paths, so a crafted request can read or write files outside the intended directory. The advisory rates it critical (CVSS 9.1), and the sources do not say what a request needs to reach the flaw.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-iotdb","iotdb-server","java","maven","time-series-database"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads or writes files outside the intended directory on the server","analyst_note":"Confirm whether authentication or a non-default setting is required to trigger the traversal, from the GHSA-xrvj-h9w2-3q69 advisory page.","how_to_check":"- Check the installed `iotdb-server` version in your Maven dependencies or deployment, and see whether it falls in `>= 2.0.0, < 2.0.6` or `>= 1.0.0, < 1.3.6`.\n- unknown for exact exposure conditions: the sources do not say which configuration or endpoint is needed.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-affected-ranges"],"who_is_affected":"Teams running Apache IoTDB server versions 2.0.0 to before 2.0.6 or 1.0.0 to before 1.3.6. The sources do not say whether default configuration or authentication limits exposure, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4338,"output_tokens":625,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':9A,17A '-22':31B '-55017':10A,18A '1.0.0':107C '1.3.6':109C,117C '2.0.0':103C '2.0.6':105C,119C '3q69':15A '9.1':67B 'advisori':62B 'affect':99C 'apach':1A,28B,42B,95C,100C 'apache-iotdb':27B 'craft':50B 'critic':65B 'cve':8A,16A 'cvss':66B 'cwe':30B 'databas':41B 'directori':60B,90C 'file':46B,56B 'fix':121C 'flaw':81B 'ghsa':12A 'ghsa-xrvj-h9w2-3q69':11A 'h9w2':14A 'improp':82C 'intend':59B 'iotdb':2A,21A,25A,29B,33B,43B,96C,101C 'iotdb-serv':32B 'iotdb-server':20A,24A 'issu':98C,123C 'java':35B 'limit':83C 'maven':36B 'mishandl':45B 'need':77B 'org.apache.iotdb':19A,23A 'outsid':57B 'packag':37B 'path':5A,47B,91C 'pathnam':86C 'rate':63B 'reach':79B 'read':53B 'recommend':112C 'request':51B,76B 'restrict':89C 'say':73B 'seri':40B 'server':22A,26A,34B,44B 'sourc':70B 'time':39B 'time-series-databas':38B 'travers':6A,92C 'upgrad':114C 'user':110C 'version':116C 'vulner':7A,93C 'write':55B 'xrvj':13A","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache IoTDB server versions 2.0.0 to before 2.0.6 or 1.0.0 to before 1.3.6. The sources do not say whether default configuration or authentication limits exposure, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["orgapacheiotdbiotdbserver"],"ptokens":["apache","iotdb","org","server"],"labels":["apacheiotdb","critical","cwe22","iotdbserver","java","maven","package","timeseriesdatabase"],"campaign_type":null,"first_public_at":"2026-06-26T13:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xrvj-h9w2-3q69","url":"https://github.com/advisories/GHSA-xrvj-h9w2-3q69","severity":"critical","published_at":"2026-06-26T15:32:13+00:00","modified_at":"2026-11-03T21:54:17+00:00","first_seen_at":"2026-11-03T21:57:17+00:00","fetched_at":"2026-11-03T22:02:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-55017","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55017","severity":null,"published_at":"2026-06-26T13:16:33+00:00","modified_at":"2026-09-29T20:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":61003,"url":"https://github.com/apache/iotdb/pull/16097","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61004,"url":"https://github.com/apache/iotdb/pull/16098","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61005,"url":"https://github.com/apache/iotdb/commit/6c27518610776be16dc998403918e978968a7325","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61006,"url":"https://github.com/apache/iotdb/commit/9a15b5d13f5b19f13ddb46b799567fbabcb0e541","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61007,"url":"https://github.com/apache/iotdb/releases/tag/v1.3.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":61008,"url":"https://github.com/apache/iotdb/releases/tag/v2.0.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}